chore(deps): update dependency @angular/compiler to v19 [security] #1090

renovate-rancher · 2025-12-02T06:47:39Z

Note: This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
@angular/compiler (source)	`14.3.0` → `19.0.0`

Angular has XSS Vulnerability via Unsanitized SVG Script Attributes

CVE-2026-22610 / GHSA-jrmj-c5cx-3cw6

More information

Details

A Cross-Site Scripting (XSS) vulnerability has been identified in the Angular Template Compiler. The vulnerability exists because Angular’s internal sanitization schema fails to recognize the href and xlink:href attributes of SVG <script> elements as a Resource URL context.

In a standard security model, attributes that can load and execute code (like a script's source) should be strictly validated. However, because the compiler does not classify these specific SVG attributes correctly, it allows attackers to bypass Angular's built-in security protections.

When template binding is used to assign user-controlled data to these attributes for example, <script [attr.href]="userInput"> the compiler treats the value as a standard string or a non-sensitive URL rather than a resource link. This enables an attacker to provide a malicious payload, such as a data:text/javascript URI or a link to an external malicious script.

Impact

When successfully exploited, this vulnerability allows for arbitrary JavaScript execution within the context of the victim's browser session. This can lead to:

Session Hijacking: Stealing session cookies, localStorage data, or authentication tokens.
Data Exfiltration: Accessing and transmitting sensitive information displayed within the application.
Unauthorized Actions: Performing state-changing actions (like clicking buttons or submitting forms) on behalf of the authenticated user.

Attack Preconditions

The victim application must explicitly use SVG <script> elements within its templates.
The application must use property or attribute binding (interpolation) for the href or xlink:href attributes of those SVG scripts.
The data bound to these attributes must be derived from an untrusted source (e.g., URL parameters, user-submitted database entries, or unsanitized API responses).

Patches

19.2.18
20.3.16
21.0.7
21.1.0-rc.0

Workarounds

Until the patch is applied, developers should:

Avoid Dynamic Bindings: Do not use Angular template binding (e.g., [attr.href]) for SVG <script> elements.
Input Validation: If dynamic values must be used, strictly validate the input against a strict allowlist of trusted URLs on the server side or before it reaches the template.

Resources

https://github.com/angular/angular/pull/66318

Severity

CVSS Score: 8.5 / 10 (High)
Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Angular Stored XSS Vulnerability via SVG Animation, SVG URL and MathML Attributes

CVE-2025-66412 / GHSA-v4hv-rgfq-gp49

More information

Details

A Stored Cross-Site Scripting (XSS) vulnerability has been identified in the Angular Template Compiler. It occurs because the compiler's internal security schema is incomplete, allowing attackers to bypass Angular's built-in security sanitization. Specifically, the schema fails to classify certain URL-holding attributes (e.g., those that could contain javascript: URLs) as requiring strict URL security, enabling the injection of malicious scripts.

Additionally, a related vulnerability exists involving SVG animation elements (<animate>, <set>, <animateMotion>, <animateTransform>). The attributeName attribute on these elements was not properly validated, allowing attackers to dynamically target security-sensitive attributes like href or xlink:href on other elements. By binding attributeName to "href" and providing a javascript: URL in the values or to attribute, an attacker could bypass sanitization and execute arbitrary code.

Attributes confirmed to be vulnerable include:

SVG-related attributes: (e.g., xlink:href), and various MathML attributes (e.g., math|href, annotation|href).
SVG animation attributeName attribute when bound to "href" or "xlink:href".

When template binding is used to assign untrusted, user-controlled data to these attributes (e.g., [attr.xlink:href]="maliciousURL" or <animate [attributeName]="'href'" [values]="maliciousURL">), the compiler incorrectly falls back to a non-sanitizing context or fails to block the dangerous attribute assignment. This allows an attacker to inject a javascript:URL payload. Upon user interaction (like a click) on the element, or automatically in the case of animations, the malicious JavaScript executes in the context of the application's origin.

Impact

When exploited, this vulnerability allows an attacker to execute arbitrary code within the context of the vulnerable application's domain. This enables:

Session Hijacking: Stealing session cookies and authentication tokens.
Data Exfiltration: Capturing and transmitting sensitive user data.
Unauthorized Actions: Performing actions on behalf of the user.

Patches

19.2.17
20.3.15
21.0.2

Attack Preconditions

The victim's Angular application must render data derived from untrusted input (e.g., from a database or API) and bind it to one of the unsanitized URL attributes or the attributeName of an SVG animation element.
The victim must perform a user interaction (e.g., clicking) on the compromised element for the stored script to execute, or the animation must trigger the execution.

Workarounds

If you cannot upgrade, you can workaround the issue by ensuring that any data bound to the vulnerable attributes is never sourced from untrusted user input (e.g., database, API response, URL parameters).

Avoid Affected Template Bindings: Specifically avoid using template bindings (e.g., [attr.xlink:href]="maliciousURL") to assign untrusted data to the vulnerable SVG/MathML attributes.
Avoid Dynamic attributeName on SVG Animations: Do not bind untrusted data to the attributeName attribute of SVG animation elements (<animate>, <set>, etc.).
Enable Content Security Policy (CSP): Configure a robust CSP header that disallows javascript: URLs.

Severity

CVSS Score: 8.5 / 10 (High)
Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Release Notes

angular/angular (@angular/compiler)

`v19.0.0`

Compare Source

Blog post: https://blog.angular.dev/meet-angular-v19-7b29dfd05b84

Breaking Changes

compiler

this.foo property reads no longer refer to template context variables. If you intended to read the template variable, do not use this..
changes to CSS selectors parsing where introduced, mainly to: pseudo selectors :where() and :is(),
parsing of :host and host-context, parsing selectors within pseudo selector arguments (for instance comma separated selectors).
These changes could lead to a different specificity of the resulting selectors and/or previously broken selectors being applied now,
for example :where(:host) used to transform to :where()[ng-host] and is being :where([ng-host]) now. Unlike the previous outcome,
the new result can target elements and therefore could lead to breakages.

core

Angular directives, components and pipes are now standalone by default.
- Specify standalone: false for declarations that are currently declared in @NgModules.
- ng update for v19 will take care of this automatically.
TypeScript versions less than 5.5 are no longer supported.
Timing changes for effect API (in developer preview):
- effects which are triggered outside of change detection run as part of
  the change detection process instead of as a microtask. Depending on the
  specifics of application/test setup, this can result in them executing
  earlier or later (or requiring additional test steps to trigger; see below
  examples).
- effects which are triggered during change detection (e.g. by input
  signals) run earlier, before the component's template.
ExperimentalPendingTasks has been renamed to PendingTasks.
The autoDetect feature of ComponentFixture will now
attach the fixture to the ApplicationRef. As a result, errors during
automatic change detection of the fixture be reported to the ErrorHandler.
This change may cause custom error handlers to observe new failures that were previously unreported.

createComponent will now render default fallback with empty projectableNodes.

When passing an empty array to projectableNodes in the createComponent API, the default fallback content
of the ng-content will be rendered if present. To prevent rendering the default content, pass document.createTextNode('') as a projectableNode.

// The first ng-content will render the default fallback content if present
createComponent(MyComponent. { projectableNodes: [[], [secondNode]] });

// To prevent projecting the default fallback content:
createComponent(MyComponent. { projectableNodes: [[document.createTextNode('')], [secondNode]] });

Errors that are thrown during ApplicationRef.tick
will now be rethrown when using TestBed. These errors should be
resolved by ensuring the test environment is set up correctly to
complete change detection successfully. There are two alternatives to
catch the errors:
- Instead of waiting for automatic change detection to happen, trigger
  it synchronously and expect the error. For example, a jasmine test
  could write expect(() => TestBed.inject(ApplicationRef).tick()).toThrow()
- TestBed will reject any outstanding ComponentFixture.whenStable promises. A jasmine test,
  for example, could write expectAsync(fixture.whenStable()).toBeRejected().
As a last resort, you can configure errors to not be rethrown by
setting rethrowApplicationErrors to false in TestBed.configureTestingModule.
The timers that are used for zone coalescing and hybrid
mode scheduling (which schedules an application state synchronization
when changes happen outside the Angular zone) will now run in the zone
above Angular rather than the root zone. This will mostly affect tests
which use fakeAsync: these timers will now be visible to fakeAsync
and can be affected by tick or flush.
The deprecated factories property in KeyValueDiffers has been removed.

elements

as part of switching away from custom CD behavior to the
hybrid scheduler, timing of change detection around custom elements has
changed subtly. These changes make elements more efficient, but can cause
tests which encoded assumptions about how or when elements would be checked
to require updating.

localize

The name option in the ng add @localize``schematic has been removed in favor of theproject option.

platform-browser

The deprecated BrowserModule.withServerTransition method has been removed. Please use the APP_ID DI token to set the application id instead.

router

The Router.errorHandler property has been removed.
Adding an error handler should be configured in either
withNavigationErrorHandler with provideRouter or the errorHandler
property in the extra options of RouterModule.forRoot. In addition,
the error handler cannot be used to change the return value of the
router navigation promise or prevent it from rejecting. Instead, if you
want to prevent the promise from rejecting, use resolveNavigationPromiseOnError.
The return type of the Resolve interface now includes
RedirectCommand.

common

Commit	Type	Description
24c6373820	feat	add optional rounded transform support in cloudinary image loader (#55364)
50f08e6c4b	feat	automatically use sizes auto in NgOptimizedImage (#57479)
13c13067bc	feat	disable keyvalue sorting using null compareFn (#57487)

compiler

Commit	Type	Description
a2e4ee0cb3	feat	add diagnostic for unused standalone imports (#57605)
0c9d721ac1	feat	add support for the `typeof` keyword in template expressions. (#58183)
09f589f000	fix	`this.a` should always refer to class property `a` (#55183)
98804fd4be	fix	add more specific matcher for hydrate never block (#58360)
b25121ee4a	fix	avoid having to duplicate core environment (#58444)
560282aa9b	fix	control flow nodes with root at the end projected incorrectly (#58607)
2be161d015	fix	fix `:host` parsing in pseudo-selectors (#58681)
806a61b5a6	fix	fix multiline selectors (#58681)
a3cb530d84	fix	handle typeof expressions in serializer (#58217)
ba4340875a	fix	ignore placeholder-only i18n messages (#58154)
e5d3abb298	fix	resolve `:host:host-context(.foo)` (#58681)
80f56954ce	fix	transform chained pseudo-selectors (#58681)

compiler-cli

Commit	Type	Description
d9687f43dd	feat	'strictStandalone' flag enforces standalone (#57935)
9e87593055	feat	ensure template style elements are preprocessed as inline styles (#57429)
231e6ff6ca	feat	generate the HMR replacement module (#58205)
dbe612f2cd	fix	disable standalone by default on older versions of Angular (#58405)
d4d76ead80	fix	do not fail fatal when references to non-existent module are discovered (#58515)
33fe252c58	fix	do not report unused declarations coming from an imported array (#57940)
fb44323c51	fix	incorrectly generating relative file paths on case-insensitive platforms (#58150)
22cd6869ef	fix	make the unused imports diagnostic easier to read (#58468)
9bbb01c85e	fix	report individual diagnostics for unused imports (#58589)
4716c3b966	perf	reduce duplicate component style resolution (#57502)

core

Commit	Type	Description
6ea8e1e9aa	feat	Add a schematics to migrate to `standalone: false`. (#57643)
3ebe6b4ad4	feat	Add async `run` method on `ExperimentalPendingTasks` (#56546)
69fc5ae922	feat	Add incremental hydration public api (#58249)
8ebbae88ca	feat	Add rxjs operator prevent app stability until an event (#56533)
19edf2c057	feat	add syntactic sugar for initializers (#53152)
c93b510f9b	feat	allow passing `undefined` without needing to include it in the type argument of `input` (#57621)
ab25a192ba	feat	allow running output migration on a subset of paths (#58299)
fc59e2a7b7	feat	change effect() execution timing & no-op `allowSignalWrites` (#57874)
8bcc663a53	feat	drop support for TypeScript 5.4 (#57577)
18d8d44b1f	feat	experimental `resource()` API for async dependencies (#58255)
9762b24b5e	feat	experimental impl of `rxResource()` (#58255)
6b8c494d05	feat	flipping the default value for `standalone` to `true` (#58169)
e6e5d29e83	feat	initial version of the output migration (#57604)
be2e49639b	feat	introduce `afterRenderEffect` (#57549)
ec386e7f12	feat	introduce debugName optional arg to framework signal functions (#57073)
8311f00faa	feat	introduce the reactive linkedSignal (#58189)
1b1519224d	feat	mark input, output and model APIs as stable (#57804)
a7eff3ffaa	feat	mark signal-based query APIs as stable (#57921)
a1f229850a	feat	migrate ExperimentalPendingTasks to PendingTasks (#57533)
3f1e7ab6ae	feat	promote `outputFromObservable` & `outputToObservable` to stable. (#58214)
97c44a1d6c	feat	Promote `takeUntilDestroyed` to stable. (#58200)
e5adf92965	feat	stabilize `@let` syntax (#57813)
b063468027	feat	support TypeScript 5.6 (#57424)
819ff034ce	feat	treat directives, pipes, components as by default (#58229)
ee426c62f0	fix	allow signal write error (#57973)
c095679f92	fix	avoid breaking change with apps using rxjs 6.x (#58341)
71ee81af2c	fix	clean up event contract once hydration is done (#58174)
f03d274e87	fix	ComponentFixture autoDetect feature works like production (#55228)
950a5540f1	fix	Ensure the `ViewContext` is retained after closure minification (#57903)
7b1e5be20b	fix	fallback to default ng-content with empty projectable nodes. (#57480)
0300dd2e18	fix	Fix fixture.detectChanges with autoDetect disabled and zoneless (#57416)
5fe57d4fbb	fix	fixes issues with control flow and incremental hydration (#58644)
51933ef5a6	fix	prevent errors on contract cleanup (#58614)
fd7716440b	fix	Prevents trying to trigger incremental hydration on CSR (#58366)
656b5d3e78	fix	Re-assign error codes to be within core bounds (<1000) (#53455)
6e0af6dbbb	fix	resolve forward-referenced host directives during directive matching (#58492)
468d3fb9b1	fix	rethrow errors during ApplicationRef.tick in TestBed (#57200)
226a67dabb	fix	Schedulers run in zone above Angular rather than root (#57553)
97fb86d331	perf	set encapsulation to `None` for empty component styles (#57130)
c15ec36bd1	refactor	remove deprecated `factories` Property in `KeyValueDiffers` (#58064)

elements

Commit	Type	Description
fe5c4e086a	fix	support `output()`-shaped outputs (#57535)
0cebfd7462	fix	switch to `ComponentRef.setInput` & remove custom scheduler (#56728)

forms

Commit	Type	Description
3e7d724037	feat	add ability to clear a FormRecord (#50750)
18b6f3339f	fix	fix FormRecord type inference (#50750)

http

Commit	Type	Description
4b9accdf16	feat	promote `withRequestsMadeViaParent` to stable. (#58221)
057cf7fb6b	fix	preserve all headers from Headers object (#57802)

language-service

Commit	Type	Description
8da9fb49b5	feat	add code fix for unused standalone imports (#57605)
1f067f4507	feat	add code reactoring action to migrate `@Input` to signal-input (#57214)
56ee47f2ec	feat	allow code refactorings to compute edits asynchronously (#57214)
bc83fc1e2e	feat	support converting to signal queries in VSCode extension (#58106)
5c4305f024	feat	support migrating full classes to signal inputs in VSCode (#57975)
6342befff8	feat	support migrating full classes to signal queries (#58263)
7ecfd89592	fix	The suppress diagnostics option should work for external templates (#57873)

localize

Commit	Type	Description
9c3bd1b5d1	refactor	remove deprecated `name` option. (#58063)

migrations

Commit	Type	Description
dff4de0f75	feat	add a combined migration for all signals APIs (#58259)
b6bc93803c	feat	add schematic to migrate to signal queries (#58032)
2bfc64daf1	feat	expose output as function migration (#58299)
59fe9bc772	feat	introduce signal input migration as `ng generate` schematic (#57805)
90c7ec39a0	fix	inject migration always inserting generated variables before super call (#58393)
7a65cdd911	fix	inject migration not inserting generated code after super call in some cases (#58393)
c1aa411cf1	fix	properly resolve tsconfig paths on windows (#58137)
e26797b38e	fix	replace removed NgModules in tests with their exports (#58627)

platform-browser

Commit	Type	Description
c36a1c023b	fix	correctly add external stylesheets to ShadowDOM components (#58482)
5c61f46409	refactor	remove deprecated `BrowserModule.withServerTransition` method (#58062)

platform-server

Commit	Type	Description
9e82559de4	fix	destroy `PlatformRef` when error happens during the `bootstrap()` phase (#58112)

router

Commit	Type	Description
f271021e19	feat	Add `routerOutletData` input to `RouterOutlet` directive (#57051)
b2790813a6	fix	Align RouterModule.forRoot errorHandler with provider error handler (#57050)
a49c35ec76	fix	remove setter for `injector` on `OutletContext` (#58343)
7436d3180e	fix	Update Resolve interface to include RedirectCommand like ResolveFn (#57309)

service-worker

Commit	Type	Description
8ddce80a0b	feat	allow specifying maxAge for entire application (#49601)
1479af978c	feat	finish implementation of refreshAhead feature (#53356)

`v18.2.14`

Compare Source

Breaking Changes

core

The server-side bootstrapping process has been changed to eliminate the reliance on a global platform injector.

Before:
```
const bootstrap = () => bootstrapApplication(AppComponent, config);
```
After:
```
const bootstrap = (context: BootstrapContext) =>
  bootstrapApplication(AppComponent, config, context);
```
A schematic is provided to automatically update main.server.ts files to pass the BootstrapContext to the bootstrapApplication call.

In addition, getPlatform() and destroyPlatform() will now return null and be a no-op respectively when running in a server environment.

(cherry picked from commit 8bf80c9)

core

Commit	Type	Description
9d1fb33f5e	fix	introduce `BootstrapContext` for improved server bootstrapping (#63640)

`v18.2.13`

Compare Source

migrations

Commit	Type	Description
06d70a25ea	fix	take care of tests that import both HttpClientModule & HttpClientTestingModule. (#58777)

`v18.2.12`

Compare Source

compiler-cli

Commit	Type	Description
4c38160853	fix	correct extraction of generics from type aliases (#58548)

`v18.2.11`

Compare Source

core

Commit	Type	Description
5f2d98a1b1	fix	avoid slow stringification when checking for duplicates in dev mode (#58521)
3aa45a2fa1	fix	resolve forward-referenced host directives during directive matching (#58492) (#58500)

`v18.2.10`

Compare Source

compiler

Commit	Type	Description
69dce38e778	fix	transform pseudo selectors correctly for the encapsulated view. (#58417)

localize

Commit	Type	Description
3b989ac5bd9	fix	Adding arb format to the list of valid formats in the localization extractor cli (#58287)

`v18.2.9`

Compare Source

compiler-cli

Commit	Type	Description
b0ab653965	fix	report when NgModule imports or exports itself (#58231)

`v18.2.8`

Compare Source

compiler

Commit	Type	Description
11692c8dab	fix	add multiple :host and nested selectors support (#57796)
66dcc691f5	fix	allow combinators inside pseudo selectors (#57796)
48a1437e77	fix	fix comment typo (#57796)
d325f9b55f	fix	fix parsing of the :host-context with pseudo selectors (#57796)
aea747ab3b	fix	preserve attributes attached to :host selector (#57796)

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Renovate Bot.

chore(deps): update dependency @angular/compiler to v19 [security]

d604247

renovate-rancher bot requested a review from a team as a code owner December 2, 2025 06:47

renovate-rancher bot added the dependencies label Dec 2, 2025

renovate-rancher bot requested a review from xingzhang-suse December 2, 2025 06:47

renovate-rancher bot added the dependencies label Dec 2, 2025

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore(deps): update dependency @angular/compiler to v19 [security] #1090

chore(deps): update dependency @angular/compiler to v19 [security] #1090

Uh oh!

renovate-rancher bot commented Dec 2, 2025 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

chore(deps): update dependency @angular/compiler to v19 [security] #1090

Are you sure you want to change the base?

chore(deps): update dependency @angular/compiler to v19 [security] #1090

Uh oh!

Conversation

renovate-rancher bot commented Dec 2, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Angular has XSS Vulnerability via Unsanitized SVG Script Attributes

Details

Impact

Attack Preconditions

Patches

Workarounds

Resources

Severity

References

Angular Stored XSS Vulnerability via SVG Animation, SVG URL and MathML Attributes

Details

Impact

Patches

Attack Preconditions

Workarounds

Severity

References

Release Notes

Breaking Changes

compiler

core

elements

localize

platform-browser

router

common

compiler

compiler-cli

core

elements

forms

http

language-service

localize

migrations

platform-browser

platform-server

router

service-worker

Breaking Changes

core

core

migrations

compiler-cli

core

compiler

localize

compiler-cli

compiler

Configuration

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

renovate-rancher bot commented Dec 2, 2025 •

edited

Loading