CVE-2026-52725: Angular Script Injection via Dynamic Component Creation

Technical summary

The @angular/core package's createComponent API fails to validate and reject host elements that are script-execution contexts. Specifically, when instantiating dynamic components, the framework does not prevent attachment to <script> elements or namespaced variants such as <svg:script>. An attacker controlling the host element selector or the mounting context can leverage this to initialize a component on a script tag, triggering script execution. The vulnerability stems from insufficient validation in the dynamic component instantiation mechanism prior to DOM attachment. This affects Angular versions prior to 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23. The CVSS 3.1 score of 6.1 (MEDIUM) reflects network exploitability, low attack complexity, no privilege requirement, and user interaction as a prerequisite.

Business impact

Applications using vulnerable Angular versions in user-facing web interfaces face elevated XSS risk. If an attacker can influence which component gets mounted or where it mounts—through malicious input, compromised third-party libraries, or insecure application logic—they can execute arbitrary JavaScript with the same privileges as the web application. This could enable credential theft, session hijacking, defacement, or exfiltration of sensitive user data. The attack requires user interaction, limiting the scope somewhat, but the consequence is full client-side compromise. Development teams relying on Angular's security model must patch immediately to restore the intended protection boundaries.

Affected systems

All Angular applications using versions prior to 22.0.0-rc.2 (current dev), 21.2.15, 20.3.22, or 19.2.23 are affected. This includes any project using @angular/core from these older version families. The vulnerability applies regardless of platform (web, mobile-web, or desktop-web via Electron or similar), provided the application uses the createComponent API. Developers should verify their current Angular version and update to the patched releases.

Exploitability

This vulnerability requires an attacker to control the component being instantiated or the host element selector passed to createComponent. The attack surface exists when an application accepts user input that influences component mounting decisions, or when third-party libraries have untrusted code paths. The attack is not automatically triggered; it demands either application-level misconfiguration or a supply-chain compromise. The user-interaction requirement (indicated by the CVSS vector) means the user must visit a malicious or compromised page or trigger the vulnerable code path. While not trivial to exploit in well-architected applications, it presents a meaningful risk in applications with dynamic component logic or untrusted input handling.

Remediation

Upgrade Angular immediately to version 22.0.0-rc.2, 21.2.15, 20.3.22, or 19.2.23 or later, depending on your current major version line. These releases include validation to reject mounting components onto script elements. Run 'npm update @angular/core' or update your package.json and reinstall dependencies. After patching, rebuild and re-test your application, particularly any code paths involving dynamic component creation or user-influenced component placement. Review application code for patterns where user input or external data controls component mounting; refactor to eliminate such control flow where possible.

Patch guidance

Angular provides patched versions across multiple support lines: verify against the vendor advisory (angular.io/guide/releases) for your specific version. For production environments on older major versions (19.x, 20.x, 21.x), update to the respective patch release. Teams on 22.x should update to rc.2 or later. Patch testing should focus on dynamic component creation scenarios. No breaking changes are expected in patch releases. Plan the upgrade during your next maintenance window; do not delay given the nature of XSS vulnerabilities.

Detection guidance

Monitor Angular application logs and network traffic for unusual component mounting patterns. Code review tools can flag uses of createComponent with externally-controlled host selectors. Static analysis should identify dynamic component instantiation without validation of the host element. Security testing should include scenarios where user input might influence component placement. Browser-based detection is difficult (XSS payloads would execute before detection), so prevention via patching and secure coding practices is paramount. Monitor your dependency tree for outdated @angular/core versions in development and production environments.

Why prioritize this

Despite a MEDIUM CVSS score, this vulnerability should be prioritized because XSS vulnerabilities enable direct compromise of user sessions and data. The attack surface is broad (any application using dynamic components), and the impact is severe (arbitrary code execution). The lack of CISA KEV listing does not diminish the need for rapid patching; patches are readily available and low-risk. Organizations should treat this as a priority update, especially for applications handling sensitive data or serving high-traffic user bases.

Risk score, explained

The CVSS 3.1 score of 6.1 reflects: network-accessible attack vector (AV:N), low attack complexity (AC:L), no privilege requirement (PR:N), and required user interaction (UI:R). Scope is changed (S:C), indicating impact beyond the vulnerable component. Confidentiality and integrity are both impacted (C:L, I:L), but availability is not (A:N). This is a typical XSS profile—easily exploitable but requiring some form of user engagement. The MEDIUM classification is appropriate for a client-side XSS; however, context (data sensitivity, user base size) may warrant treating it as HIGH priority operationally.

Frequently asked questions