Note: This PR body was truncated due to platform limits.
This PR contains the following updates:
GitHub Vulnerability Alerts
A Stored Cross-Site Scripting (XSS) vulnerability has been identified in the Angular Template Compiler. It occurs because the compiler's internal security schema is incomplete, allowing attackers to bypass Angular's built-in security sanitization. Specifically, the schema fails to classify certain URL-holding attributes (e.g., those that could contain javascript: URLs) as requiring strict URL security, enabling the injection of malicious scripts.
Additionally, a related vulnerability exists involving SVG animation elements (<animate>, <set>, <animateMotion>, <animateTransform>). The attributeName attribute on these elements was not properly validated, allowing attackers to dynamically target security-sensitive attributes like href or xlink:href on other elements. By binding attributeName to "href" and providing a javascript: URL in the values or to attribute, an attacker could bypass sanitization and execute arbitrary code.
Attributes confirmed to be vulnerable include:
- SVG-related attributes: (e.g.,
xlink:href), and various MathML attributes (e.g., math|href, annotation|href).
- SVG animation
attributeName attribute when bound to "href" or "xlink:href".
When template binding is used to assign untrusted, user-controlled data to these attributes (e.g., [attr.xlink:href]="maliciousURL" or <animate [attributeName]="'href'" [values]="maliciousURL">), the compiler incorrectly falls back to a non-sanitizing context or fails to block the dangerous attribute assignment. This allows an attacker to inject a javascript:URL payload. Upon user interaction (like a click) on the element, or automatically in the case of animations, the malicious JavaScript executes in the context of the application's origin.
Impact
When exploited, this vulnerability allows an attacker to execute arbitrary code within the context of the vulnerable application's domain. This enables:
- Session Hijacking: Stealing session cookies and authentication tokens.
- Data Exfiltration: Capturing and transmitting sensitive user data.
- Unauthorized Actions: Performing actions on behalf of the user.
Patches
Attack Preconditions
- The victim's Angular application must render data derived from untrusted input (e.g., from a database or API) and bind it to one of the unsanitized URL attributes or the
attributeName of an SVG animation element.
- The victim must perform a user interaction (e.g., clicking) on the compromised element for the stored script to execute, or the animation must trigger the execution.
Workarounds
If you cannot upgrade, you can workaround the issue by ensuring that any data bound to the vulnerable attributes is never sourced from untrusted user input (e.g., database, API response, URL parameters).
- Avoid Affected Template Bindings: Specifically avoid using template bindings (e.g.,
[attr.xlink:href]="maliciousURL") to assign untrusted data to the vulnerable SVG/MathML attributes.
- Avoid Dynamic
attributeName on SVG Animations: Do not bind untrusted data to the attributeName attribute of SVG animation elements (<animate>, <set>, etc.).
- Enable Content Security Policy (CSP): Configure a robust CSP header that disallows
javascript: URLs.
Release Notes
angular/angular (@angular/compiler)
Compare Source
compiler
| Commit |
Type |
Description |
| d1ca8ae043 |
fix |
prevent XSS via SVG animation attributeName and MathML/SVG URLs |
Compare Source
http
| Commit |
Type |
Description |
| 0276479e7d |
fix |
prevent XSRF token leakage to protocol-relative URLs |
Compare Source
Compare Source
Compare Source
common
| Commit |
Type |
Description |
| 5047849a4a |
fix |
remove placeholder image listeners once view is removed |
compiler
| Commit |
Type |
Description |
| f9d0818087 |
fix |
support arbitrary nesting in :host-context() |
| 106b9040df |
fix |
support commas in :host() argument |
| 9419ea348a |
fix |
support complex selectors in :nth-child() |
| 036c5d2a07 |
fix |
support one additional level of nesting in :host() |
core
| Commit |
Type |
Description |
| dcdd1bcdbb |
fix |
skip leave animations on view swaps |
Compare Source
compiler-cli
migrations
| Commit |
Description |
| fix - a45e6b2b66 |
Prevent removal of templates referenced with preceding whitespace characters |
Compare Source
Compare Source
animations
| Commit |
Type |
Description |
| bd38cd45a5 |
fix |
account for Element.animate exceptions (#64506) |
compiler
| Commit |
Type |
Description |
| 891f180262 |
fix |
correctly compile long numeric HTML entities (#64297) |
compiler-cli
| Commit |
Type |
Description |
| 371274bfc6 |
fix |
missingStructuralDirective diagnostic produces false negatives (#64470) |
core
| Commit |
Type |
Description |
| 4c89a267c3 |
fix |
pass element removal property through in all locations (#64565) |
| 2fad4d4ab6 |
fix |
prevent duplicate nodes from being retained with fast `animate.leave`` calls (#64592) |
router
| Commit |
Type |
Description |
| cfd8ed3fff |
fix |
Fix outlet serialization and parsing with no primary children (#64505) |
| 182fe78f91 |
fix |
Surface parse errors in Router.parseUrl (#64503) |
Compare Source
core
platform-browser
| Commit |
Type |
Description |
| 2ece42866d |
fix |
DomEventsPlugin should always be the last plugin to be called for supports(). (#50394) |
Compare Source
compiler-cli
core
| Commit |
Type |
Description |
| f15cfa4cc4 |
fix |
fixes regression in animate.leave function bindings (#64413) |
| d54dd674ca |
fix |
Prevents early style pruning with leave animations (#64335) |
migrations
router
| Commit |
Type |
Description |
| 6e4bcc7d22 |
fix |
Scroll restoration should use instant scroll behavior for traversals (#64299) |
Compare Source
core
| Commit |
Type |
Description |
| 853ed169a8 |
fix |
ensure missing leave animations don't queue leave animations (#64226) |
| 6fed986b7a |
fix |
Fixes animations in conjunction with content projection (#63776) |
| 76fe5599fe |
fix |
handle undefined CSS time values in parseCssTimeUnitsToMs function (#64181) |
| 3b959105be |
fix |
prevent early exit from leave animations when multiple transitions are present (#64225) |
migrations
| Commit |
Type |
Description |
| 65884895ff |
fix |
preserve component imports when pruning NgModules in standalone migration (#64186) |
Compare Source
compiler
| Commit |
Type |
Description |
| f51ab32fb3 |
fix |
recover template literals with broken expressions (#64150) |
core
| Commit |
Type |
Description |
| 542cd0019a |
fix |
do not rename ARIA property bindings to attributes (#64089) |
| 0e928fbc4a |
fix |
Fixes animations in conjunction with content projection (#63776) |
| e5157bd933 |
fix |
prevents unintended early termination of leave animations and hoisting (#64088) |
migrations
| Commit |
Type |
Description |
| 1710cbd7d4 |
fix |
handle shorthand property declarations in NgModule (#64160) |
| 77b6305a4b |
fix |
skip migration for inputs with 'this' references (#64142) |
Compare Source
compiler-cli
core
forms
| Commit |
Type |
Description |
| 1fd8d5d446 |
fix |
Emit FormResetEvent when resetting control (#64034) |
migrations
Compare Source
compiler
compiler-cli
| Commit |
Type |
Description |
| 8843707919 |
fix |
only bind inputs that are part of microsyntax to a structural directive (#52453) |
| 38c9921ff3 |
fix |
signal not invoked diagnostic not raised when input has same name in template (#63754) |
core
| Commit |
Type |
Description |
| 802dbcc2a0 |
fix |
prevent animation events from being cleaned up on destroy (#63414) |
| 3ec8a5c753 |
fix |
Prevent leave animations on a move operation (#63745) |
migrations
Compare Source
Breaking Changes
core
-
The server-side bootstrapping process has been changed to eliminate the reliance on a global platform injector.
Before:
const bootstrap = () => bootstrapApplication(AppComponent, config);
After:
const bootstrap = (context: BootstrapContext) =>
bootstrapApplication(AppComponent, config, context);
A schematic is provided to automatically update main.server.ts files to pass the BootstrapContext to the bootstrapApplication call.
In addition, getPlatform() and destroyPlatform() will now return null and be a no-op respectively when running in a server environment.
(cherry picked from commit 8bf80c9)
| Commit |
Type |
Description |
| a3f808d7c8 |
fix |
remove refresh button from transfer state tab (#63592) |
core
| Commit |
Type |
Description |
| 6117ccee2e |
feat |
introduce BootstrapContext for improved server bootstrapping (#63636) |
Compare Source
core
| Commit |
Type |
Description |
| dc64f3e478 |
fix |
Fixed inject migration schematics for migrate destructured properties (#62832) |
platform-server
| Commit |
Type |
Description |
| d1d32db972 |
fix |
prevent false warning for duplicate state serialization (#63525) |
Compare Source
compiler
| Commit |
Type |
Description |
| 479a919f42 |
fix |
fixes regression with event parsing and animate prefix (#63470) |
core
| Commit |
Type |
Description |
| f87fad3fff |
fix |
avoid injecting internal error handler from a destroyed injector (#62275) |
| 114906d2d6 |
fix |
Fix cancellation of animation enter classes (#63442) |
| 596b545130 |
fix |
Prevent an error on cleanup when an rxResource stream threw before returning an Observable (#63342) |
Compare Source
compiler
| Commit |
Type |
Description |
| d7b6045d61 |
fix |
fixes animations on elements with structural directives (#63390) |
core
Compare Source
compiler
| Commit |
Type |
Description |
| a28672fb70 |
fix |
Keep paraenthesis in Nullish + Boolean expression. (#63292) |
Compare Source
Deprecations
animations
core
router
- The Router.getCurrentNavigation method is deprecated. Use the Router.currentNavigation signal instead.
- The Router.getCurrentNavigation method is deprecated. Use the Router.currentNavigation signal instead.
animations
| Commit |
Type |
Description |
| 9766116cea |
refactor |
deprecate the animations package (#62795) |
compiler
| Commit |
Type |
Description |
| 7767aa640c |
fix |
allow more characters in square-bracketed attribute names (#62742) |
| 7b51728813 |
fix |
fixes animation event host bindings not firing (#63217) |
compiler-cli
| Commit |
Type |
Description |
| 5abfe4a899 |
feat |
add diagnostic for uninvoked functions in text interpolation (#59191) |
| c4917074f1 |
fix |
display proper function in NG8117 message (#62842) |
| 812463c563 |
fix |
Ignore diagnostics on ngTemplateContextGuard lines in TCB (#63054) |
| 45b030b5ce |
fix |
prevent dom event assertion in TCB generation on older angular versions (#63053) |
core
forms
| Commit |
Type |
Description |
| c353497a01 |
feat |
add support for pushing an array of controls to formarray (#57102) |
http
| Commit |
Type |
Description |
| 0984b30388 |
feat |
Add redirected property to HttpResponse and HttpErrorResponse (#62675) |
| be811fee79 |
feat |
add referrer & integrity support for fetch requests in httpResource (#62461) |
| 1cf9d9064c |
feat |
Add support for fetch referrer & integrity options in HttpClient (#62417) |
| 1408baff45 |
fix |
Add missing timeout and transferCache options to HttpClient (#62586) |
language-service
platform-browser
| Commit |
Type |
Description |
| 52b8e07d6e |
feat |
Warns on conflicting hydration and blocking navigation (#62963) |
router
| Commit |
Type |
Description |
| d00b3fed58 |
feat |
add a currentNavigation signal to the Router service. (#62971) |
| 687c374826 |
feat |
add a currentNavigation signal to the Router service. (#63011) |
| 9c45c322d1 |
fix |
ensure preloaded components are properly activated (#62502) |
service-worker
| Commit
Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.
Uh oh!
There was an error while loading. Please reload this page.
This PR contains the following updates:
20.0.5→20.3.15GitHub Vulnerability Alerts
CVE-2025-66412
A Stored Cross-Site Scripting (XSS) vulnerability has been identified in the Angular Template Compiler. It occurs because the compiler's internal security schema is incomplete, allowing attackers to bypass Angular's built-in security sanitization. Specifically, the schema fails to classify certain URL-holding attributes (e.g., those that could contain
javascript:URLs) as requiring strict URL security, enabling the injection of malicious scripts.Additionally, a related vulnerability exists involving SVG animation elements (
<animate>,<set>,<animateMotion>,<animateTransform>). TheattributeNameattribute on these elements was not properly validated, allowing attackers to dynamically target security-sensitive attributes likehreforxlink:hrefon other elements. By bindingattributeNameto "href" and providing ajavascript:URL in thevaluesortoattribute, an attacker could bypass sanitization and execute arbitrary code.Attributes confirmed to be vulnerable include:
xlink:href), and various MathML attributes (e.g.,math|href,annotation|href).attributeNameattribute when bound to "href" or "xlink:href".When template binding is used to assign untrusted, user-controlled data to these attributes (e.g.,
[attr.xlink:href]="maliciousURL"or<animate [attributeName]="'href'" [values]="maliciousURL">), the compiler incorrectly falls back to a non-sanitizing context or fails to block the dangerous attribute assignment. This allows an attacker to inject ajavascript:URLpayload. Upon user interaction (like a click) on the element, or automatically in the case of animations, the malicious JavaScript executes in the context of the application's origin.Impact
When exploited, this vulnerability allows an attacker to execute arbitrary code within the context of the vulnerable application's domain. This enables:
Patches
Attack Preconditions
attributeNameof an SVG animation element.Workarounds
If you cannot upgrade, you can workaround the issue by ensuring that any data bound to the vulnerable attributes is never sourced from untrusted user input (e.g., database, API response, URL parameters).
[attr.xlink:href]="maliciousURL") to assign untrusted data to the vulnerable SVG/MathML attributes.attributeNameon SVG Animations: Do not bind untrusted data to theattributeNameattribute of SVG animation elements (<animate>,<set>, etc.).javascript:URLs.Release Notes
angular/angular (@angular/compiler)
v20.3.15Compare Source
compiler
attributeNameand MathML/SVG URLsv20.3.14Compare Source
http
v20.3.13Compare Source
v20.3.12Compare Source
v20.3.11Compare Source
common
compiler
core
v20.3.10Compare Source
compiler-cli
migrations
v20.3.9Compare Source
v20.3.7Compare Source
animations
Element.animateexceptions (#64506)compiler
compiler-cli
core
router
v20.3.6Compare Source
core
platform-browser
DomEventsPluginshould always be the last plugin to be called forsupports(). (#50394)v20.3.5Compare Source
compiler-cli
core
animate.leavefunction bindings (#64413)migrations
router
v20.3.4Compare Source
core
migrations
v20.3.3Compare Source
compiler
core
migrations
v20.3.2Compare Source
compiler-cli
core
Resource.hasValue()(#63994)animate.leave(#63921)forms
FormResetEventwhen resetting control (#64034)migrations
v20.3.1Compare Source
compiler
aria-invalid(#63748)compiler-cli
core
migrations
v20.3.0Compare Source
Breaking Changes
core
The server-side bootstrapping process has been changed to eliminate the reliance on a global platform injector.
Before:
After:
A schematic is provided to automatically update
main.server.tsfiles to pass theBootstrapContextto thebootstrapApplicationcall.In addition,
getPlatform()anddestroyPlatform()will now returnnulland be a no-op respectively when running in a server environment.(cherry picked from commit
8bf80c9)core
BootstrapContextfor improved server bootstrapping (#63636)v20.2.4Compare Source
core
platform-server
v20.2.3Compare Source
compiler
core
rxResourcestreamthrew before returning anObservable(#63342)v20.2.2Compare Source
compiler
core
@forloop animations never get cancelled (#63328)animate.leavebinding to a string with spaces (#63366)v20.2.1Compare Source
compiler
v20.2.0Compare Source
Deprecations
animations
core
router
animations
compiler
compiler-cli
core
asaliases onelse ifblocks (#63047)animate.enterclass removal when composing classes (#62981)@iftoggles with leave animations (#63048)forms
http
HttpClient(#62586)language-service
platform-browser
router
currentNavigationsignal to theRouterservice. (#62971)service-worker
| Commit
Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.