Angular Namespace Sanitization Bypass Leading to XSS (CVE-2025-50557)

Vulnerability Overview Vulnerability Name: Template and Attribute Namespace Sanitization Bypass (XSS) Vulnerability Description: A vulnerability exists in the and packages that allows bypassing element and attribute sanitization/validation through specific namespaces. Specifically, namespaced script elements (such as or ) were not correctly identified as script elements, allowing them to pass through template compilation without being stripped. Additionally, the security context mode mapping did not consistently handle attributes within namespaces (such as SVG and MathML), creating a vulnerability that allowed malicious namespaced attributes to bypass both runtime and compile-time sanitizers. These flaws enable attackers to inject or provide template/tag structures with custom namespaces to bypass Angular’s script stripping logic and attribute sanitizers, resulting in client-side Cross-Site Scripting (XSS). Affected Versions Affected Versions: - : - >= 21.0.0-next.0 = 22.0.0-next.0 = 20.0.0-next.0 = 19.0.0-next.0 = 21.0.0-next.0 = 22.0.0-next.0 = 20.0.0-next.0 = 19.0.0-next.0 < 19.2.22 - <= 18.2.14 Impact: - Any Angular application that compiles user-controlled templates at runtime or relies on namespace element/attribute sanitization is susceptible to this security vulnerability. - Once exploited, an attacker can inject namespaced script elements or dynamic attribute bindings to bypass core sanitization constraints, execute arbitrary JavaScript, and potentially lead to session hijacking, sensitive data leakage, or unauthorized operations. Remediation Patch Versions: - 22.0.0-rc.2 - 21.2.15 - 20.3.22 - 19.2.23 Attack Preconditions: - User-controlled template input: The application must accept user-controlled input at runtime that is processed directly by the Angular template compiler. - Namespace resolution support: The input structure must use custom namespace prefixes (e.g., ) to evade standard tag name blocklists/checks. - Lack of additional context sanitization: The application does not perform separate input sanitization before passing values to the Angular compiler. References CVE-2025-50557 GHSA-f3m7-ggpr-g87x Additional Information Severity: Medium CVSS v4 Base Metrics: - Attack Vector: Network - Attack Complexity: Low - Attack Requirements: None - Privileges Required: None - User Interaction: Passive - Confidentiality: Low - Integrity: Low - Availability: None Subsequent System Impact Metrics: - Confidentiality: None - Integrity: None - Availability: None Credits Finder: @Zer0Zx Remediation developer: @alan-agius4 Other: @josephperrott Remediation reviewer: @AndrewKushnir Footer © 2026 GitHub, Inc. Terms Privacy Security Status Community Docs Contact Manage cookies Do not share my personal information

Goal Reached Thanks to every supporter — we hit 100%!

Angular Namespace Sanitization Bypass Leading to XSS (CVE-2025-50557)

More from this source