CVE-2025-66035
BaseFortify
Publication date: 2025-11-26
Last updated on: 2025-11-26
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| angular | angular | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-359 | The product does not properly prevent a person's private, personal information from being accessed by actors who either (1) are not explicitly authorized to access the information or (2) do not have the implicit consent of the person about whom the information is collected. |
| CWE-201 | The code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a Cross-Site Request Forgery (XSRF) token leakage in Angular's HttpClient when using protocol-relative URLs (URLs starting with //). Angular's HttpClient incorrectly treats these URLs as same-origin requests and automatically adds the XSRF token to the request header. This leads to unauthorized disclosure of the XSRF token to attacker-controlled domains. The issue has been fixed in Angular versions 19.2.16, 20.3.14, and 21.0.1. A workaround is to avoid using protocol-relative URLs and instead use relative paths or fully qualified, trusted absolute URLs.
How can this vulnerability impact me? :
This vulnerability can lead to unauthorized disclosure of the XSRF token, which is intended to protect against Cross-Site Request Forgery attacks. If an attacker obtains this token, they could potentially perform unauthorized actions on behalf of a user by bypassing the XSRF protection, leading to compromised user accounts or unauthorized operations within the affected web application.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, avoid using protocol-relative URLs (URLs starting with //) in Angular HttpClient requests. Instead, use hardcoded relative paths starting with a single / or fully qualified, trusted absolute URLs. Additionally, upgrade Angular to versions 19.2.16, 20.3.14, or 21.0.1 or later where the issue is patched.