CVE-2026-52725 - Medium Severity Vulnerability
Vulnerable Library - core-12.2.5.tgz
Angular - the core framework
Library home page: https://registry.npmjs.org/@angular/core/-/core-12.2.5.tgz
Path to dependency file: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
- ❌ core-12.2.5.tgz (Vulnerable Library)
Found in HEAD commit: 36a9c5d28529109984de6fcc3d0a157d561dac4a
Found in base branch: master
Vulnerability Details
An issue in the "@angular/core" package allows bypassing script-execution restrictions during dynamic component creation. Specifically, the dynamic component instantiation mechanism ("createComponent") failed to reject mounting components directly onto a "<script>" or namespaced script element (such as ""svg:script" (svg:script)"). This enabled the initialization of custom components on a tag that executes scripts, allowing attackers to hijack or inject script-executing hosts. This flaw enables an attacker who can control the host element or selector parameter passed to "createComponent" to initialize or mount an Angular component directly onto a "<script>" tag, leading to execution of untrusted code or client-side Cross-Site Scripting (XSS). Impact Any Angular application that registers dynamic components based on user-supplied parameters (like selectors or host elements) is vulnerable to this security bypass. Once exploited, this allows a malicious actor to mount a dynamic component on a script tag, bypassing core dynamic component creation safeguards to execute arbitrary JavaScript within the target user's browser context. This could lead to session hijacking, sensitive data exposure, or unauthorized actions on behalf of the user. Attack Preconditions To successfully exploit these vulnerabilities, the following environment parameters and application states must all concurrently exist: 1. User-Controlled Host Selection: The application must accept user-controlled inputs that are passed as a selector/host element to "createComponent". 2. Absence of Additional Context Sanitization: The application does not perform separate input sanitization before feeding values to the dynamic creation APIs. Patches * 22.0.0-rc.2 * 21.2.15 * 20.3.22 * 19.2.23
Publish Date: 2026-06-15
URL: CVE-2026-52725
CVSS 3 Score Details (5.4)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: GHSA-692r-grfm-v8x7
Release Date: 2026-06-15
Fix Resolution: https://github.com/angular/angular.git - v19.2.23,https://github.com/angular/angular.git - v20.3.22,https://github.com/angular/angular.git - v21.2.15
CVE-2026-52725 - Medium Severity Vulnerability
Angular - the core framework
Library home page: https://registry.npmjs.org/@angular/core/-/core-12.2.5.tgz
Path to dependency file: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
Found in HEAD commit: 36a9c5d28529109984de6fcc3d0a157d561dac4a
Found in base branch: master
An issue in the "@angular/core" package allows bypassing script-execution restrictions during dynamic component creation. Specifically, the dynamic component instantiation mechanism ("createComponent") failed to reject mounting components directly onto a "<script>" or namespaced script element (such as ""svg:script" (svg:script)"). This enabled the initialization of custom components on a tag that executes scripts, allowing attackers to hijack or inject script-executing hosts. This flaw enables an attacker who can control the host element or selector parameter passed to "createComponent" to initialize or mount an Angular component directly onto a "<script>" tag, leading to execution of untrusted code or client-side Cross-Site Scripting (XSS). Impact Any Angular application that registers dynamic components based on user-supplied parameters (like selectors or host elements) is vulnerable to this security bypass. Once exploited, this allows a malicious actor to mount a dynamic component on a script tag, bypassing core dynamic component creation safeguards to execute arbitrary JavaScript within the target user's browser context. This could lead to session hijacking, sensitive data exposure, or unauthorized actions on behalf of the user. Attack Preconditions To successfully exploit these vulnerabilities, the following environment parameters and application states must all concurrently exist: 1. User-Controlled Host Selection: The application must accept user-controlled inputs that are passed as a selector/host element to "createComponent". 2. Absence of Additional Context Sanitization: The application does not perform separate input sanitization before feeding values to the dynamic creation APIs. Patches * 22.0.0-rc.2 * 21.2.15 * 20.3.22 * 19.2.23
Publish Date: 2026-06-15
URL: CVE-2026-52725
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.Type: Upgrade version
Origin: GHSA-692r-grfm-v8x7
Release Date: 2026-06-15
Fix Resolution: https://github.com/angular/angular.git - v19.2.23,https://github.com/angular/angular.git - v20.3.22,https://github.com/angular/angular.git - v21.2.15