Executive Summary

CVE-2026-52725 is a security vulnerability in the Angular framework's @angular/core package that allows attackers to bypass script-execution restrictions during dynamic component creation.

Specifically, the vulnerability arises because the createComponent function fails to reject mounting components directly onto <script> tags or namespaced script elements like <svg:script>. This enables attackers who can control the host element or selector parameter passed to createComponent to initialize or mount Angular components on script-executing tags.

As a result, attackers can execute untrusted code or perform client-side Cross-Site Scripting (XSS) attacks by injecting malicious scripts through these components.

Useful 0 Not Useful 0

Impact Analysis

If exploited, this vulnerability can allow malicious actors to execute arbitrary JavaScript code in the context of the user's browser.

• Execution of untrusted scripts leading to Cross-Site Scripting (XSS) attacks.
• Potential session hijacking by stealing authentication tokens or cookies.
• Exposure of sensitive user data.
• Unauthorized actions performed on behalf of the user.

The vulnerability affects Angular applications that dynamically create components using user-controlled inputs without proper sanitization, increasing the risk of exploitation.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves the dynamic creation of Angular components mounted onto <script> or namespaced script elements, which can lead to script execution or XSS. Detection involves identifying if your Angular application uses the createComponent method with user-controlled inputs that could mount components onto script tags.

Since this is a code-level vulnerability, detection typically requires code review or runtime monitoring rather than network commands. You should audit your Angular codebase for usages of createComponent where the host element or selector parameter might be influenced by untrusted input.

No specific network or system commands are provided in the available resources to detect this vulnerability automatically.

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation step is to upgrade the @angular/core package to a patched version where this vulnerability is fixed. The fixed versions are 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23.

Additionally, ensure that any dynamic component creation using createComponent does not mount components onto <script> or namespaced script elements. In development mode, the patched Angular framework throws runtime errors if such mounting is attempted, helping to catch unsafe usage.

Review and sanitize any user-controlled inputs that influence the host element or selector parameters passed to createComponent to prevent attackers from injecting malicious script-executing hosts.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability in Angular's @angular/core package allows attackers to execute untrusted scripts via Cross-Site Scripting (XSS) by mounting components onto script elements. This can lead to session hijacking, sensitive data exposure, or unauthorized user actions.

Such security issues can impact compliance with standards and regulations like GDPR and HIPAA, which require protection of personal and sensitive data against unauthorized access and breaches.

If exploited, this vulnerability could result in exposure of personal data or unauthorized actions within affected applications, potentially violating data protection requirements and leading to non-compliance.

Therefore, addressing this vulnerability by applying the provided patches is important to maintain compliance with these regulations.

Useful 0 Not Useful 0