feat(Dependencies): Update dependency @angular/compiler to v20.3.15 [SECURITY] #6521

renovate · 2025-12-18T07:50:31Z

This PR contains the following updates:

Package	Change	Age	Confidence
@angular/compiler (source)	`20.3.0` -> `20.3.15`

GitHub Vulnerability Alerts

CVE-2025-66412

A Stored Cross-Site Scripting (XSS) vulnerability has been identified in the Angular Template Compiler. It occurs because the compiler's internal security schema is incomplete, allowing attackers to bypass Angular's built-in security sanitization. Specifically, the schema fails to classify certain URL-holding attributes (e.g., those that could contain javascript: URLs) as requiring strict URL security, enabling the injection of malicious scripts.

Additionally, a related vulnerability exists involving SVG animation elements (<animate>, <set>, <animateMotion>, <animateTransform>). The attributeName attribute on these elements was not properly validated, allowing attackers to dynamically target security-sensitive attributes like href or xlink:href on other elements. By binding attributeName to "href" and providing a javascript: URL in the values or to attribute, an attacker could bypass sanitization and execute arbitrary code.

Attributes confirmed to be vulnerable include:

SVG-related attributes: (e.g., xlink:href), and various MathML attributes (e.g., math|href, annotation|href).
SVG animation attributeName attribute when bound to "href" or "xlink:href".

When template binding is used to assign untrusted, user-controlled data to these attributes (e.g., [attr.xlink:href]="maliciousURL" or <animate [attributeName]="'href'" [values]="maliciousURL">), the compiler incorrectly falls back to a non-sanitizing context or fails to block the dangerous attribute assignment. This allows an attacker to inject a javascript:URL payload. Upon user interaction (like a click) on the element, or automatically in the case of animations, the malicious JavaScript executes in the context of the application's origin.

Impact

When exploited, this vulnerability allows an attacker to execute arbitrary code within the context of the vulnerable application's domain. This enables:

Session Hijacking: Stealing session cookies and authentication tokens.
Data Exfiltration: Capturing and transmitting sensitive user data.
Unauthorized Actions: Performing actions on behalf of the user.

Patches

19.2.17
20.3.15
21.0.2

Attack Preconditions

The victim's Angular application must render data derived from untrusted input (e.g., from a database or API) and bind it to one of the unsanitized URL attributes or the attributeName of an SVG animation element.
The victim must perform a user interaction (e.g., clicking) on the compromised element for the stored script to execute, or the animation must trigger the execution.

Workarounds

If you cannot upgrade, you can workaround the issue by ensuring that any data bound to the vulnerable attributes is never sourced from untrusted user input (e.g., database, API response, URL parameters).

Avoid Affected Template Bindings: Specifically avoid using template bindings (e.g., [attr.xlink:href]="maliciousURL") to assign untrusted data to the vulnerable SVG/MathML attributes.
Avoid Dynamic attributeName on SVG Animations: Do not bind untrusted data to the attributeName attribute of SVG animation elements (<animate>, <set>, etc.).
Enable Content Security Policy (CSP): Configure a robust CSP header that disallows javascript: URLs.

Release Notes

angular/angular (@angular/compiler)

`v20.3.15`

Compare Source

compiler

Commit	Type	Description
d1ca8ae043	fix	prevent XSS via SVG animation `attributeName` and MathML/SVG URLs

`v20.3.14`

Compare Source

http

Commit	Type	Description
0276479e7d	fix	prevent XSRF token leakage to protocol-relative URLs

common

Commit	Type	Description
5047849a4a	fix	remove placeholder image listeners once view is removed

compiler

Commit	Type	Description
f9d0818087	fix	support arbitrary nesting in :host-context()
106b9040df	fix	support commas in :host() argument
9419ea348a	fix	support complex selectors in :nth-child()
036c5d2a07	fix	support one additional level of nesting in :host()

core

Commit	Type	Description
dcdd1bcdbb	fix	skip leave animations on view swaps

`v20.3.10`

Compare Source

compiler-cli

Commit	Description
	make required inputs diagnostic less noisy

migrations

Commit	Description
	Prevent removal of templates referenced with preceding whitespace characters

`v20.3.9`

Compare Source

`v20.3.7`

Compare Source

animations

Commit	Type	Description
bd38cd45a5	fix	account for `Element.animate` exceptions (#64506)

compiler

Commit	Type	Description
891f180262	fix	correctly compile long numeric HTML entities (#64297)

compiler-cli

Commit	Type	Description
371274bfc6	fix	missingStructuralDirective diagnostic produces false negatives (#64470)

core

Commit	Type	Description
4c89a267c3	fix	pass element removal property through in all locations (#64565)
2fad4d4ab6	fix	prevent duplicate nodes from being retained with fast `animate.leave`` calls (#64592)

router

Commit	Type	Description
cfd8ed3fff	fix	Fix outlet serialization and parsing with no primary children (#64505)
182fe78f91	fix	Surface parse errors in Router.parseUrl (#64503)

`v20.3.6`

Compare Source

core

Commit	Type	Description
911d6822cb	fix	update animation scheduling (#64441)

platform-browser

Commit	Type	Description
2ece42866d	fix	`DomEventsPlugin` should always be the last plugin to be called for `supports()`. (#50394)

`v20.3.5`

Compare Source

compiler-cli

Commit	Type	Description
8dec92ff9f	fix	capture metadata for undecorated fields (#63957) (#64317)
c2e817b0ef	perf	fix performance of "interpolated signal not invoked" check (#64410)

core

Commit	Type	Description
f15cfa4cc4	fix	fixes regression in `animate.leave` function bindings (#64413)
d54dd674ca	fix	Prevents early style pruning with leave animations (#64335)

migrations

Commit	Type	Description
554573e524	fix	migrating input with more than 1 usage in a method (#64367)
2c79ca0b57	fix	remove error for no matching files in control flow migration (#64253) (#64314)

router

Commit	Type	Description
6e4bcc7d22	fix	Scroll restoration should use instant scroll behavior for traversals (#64299)

`v20.3.4`

Compare Source

core

Commit	Type	Description
853ed169a8	fix	ensure missing leave animations don't queue leave animations (#64226)
6fed986b7a	fix	Fixes animations in conjunction with content projection (#63776)
76fe5599fe	fix	handle undefined CSS time values in parseCssTimeUnitsToMs function (#64181)
3b959105be	fix	prevent early exit from leave animations when multiple transitions are present (#64225)

migrations

Commit	Type	Description
65884895ff	fix	preserve component imports when pruning NgModules in standalone migration (#64186)

`v20.3.3`

Compare Source

compiler

Commit	Type	Description
f51ab32fb3	fix	recover template literals with broken expressions (#64150)

core

Commit	Type	Description
542cd0019a	fix	do not rename ARIA property bindings to attributes (#64089)
0e928fbc4a	fix	Fixes animations in conjunction with content projection (#63776)
e5157bd933	fix	prevents unintended early termination of leave animations and hoisting (#64088)

migrations

Commit	Type	Description
1710cbd7d4	fix	handle shorthand property declarations in NgModule (#64160)
77b6305a4b	fix	skip migration for inputs with 'this' references (#64142)

`v20.3.2`

Compare Source

compiler-cli

Commit	Type	Description
ba40153ac0	fix	capture metadata for undecorated fields (#63904)
1d4f81c8ee	fix	resolve import alias in defer blocks (#63966)

core

Commit	Type	Description
9515a70933	fix	fix narrowing of `Resource.hasValue()` (#63994)
e78451cf8a	fix	prevent animations renderer from impacting `animate.leave` (#63921)

forms

Commit	Type	Description
1fd8d5d446	fix	Emit `FormResetEvent` when resetting control (#64034)

migrations

Commit	Type	Description
16d0d43ad4	fix	handle import aliases to the same module name (#63934)
3ebaeccb46	fix	handle reused templates in control flow migration (#63996)

`v20.3.1`

Compare Source

compiler

Commit	Type	Description
7fb5a8087e	fix	Add support for `aria-invalid` (#63748)

compiler-cli

Commit	Type	Description
8843707919	fix	only bind inputs that are part of microsyntax to a structural directive (#52453)
38c9921ff3	fix	signal not invoked diagnostic not raised when input has same name in template (#63754)

core

Commit	Type	Description
802dbcc2a0	fix	prevent animation events from being cleaned up on destroy (#63414)
3ec8a5c753	fix	Prevent leave animations on a move operation (#63745)

migrations

Commit	Type	Description
6e54bdfdcb	fix	fix route-lazy-loading migration (#63818)

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

…SECURITY] | datasource | package | from | to | | ---------- | ----------------- | ------ | ------- | | npm | @angular/compiler | 20.3.0 | 20.3.15 |

renovate · 2025-12-18T07:50:34Z

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

any of the package files in this branch needs updating, or
the branch becomes conflicted, or
you click the rebase/retry checkbox if found above, or
you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: package-lock.json

npm warn Unknown env config "store". This will stop working in the next major version of npm.
npm error code ERESOLVE
npm error ERESOLVE could not resolve
npm error
npm error While resolving: @angular/[email protected]
npm error Found: @angular/[email protected]
npm error node_modules/@angular/compiler
npm error   @angular/compiler@"20.3.15" from the root project
npm error   peer @angular/compiler@"^20.0.0" from @angular/[email protected]
npm error   node_modules/@angular-devkit/build-angular/node_modules/@angular/build
npm error     @angular/build@"20.3.8" from @angular-devkit/[email protected]
npm error     node_modules/@angular-devkit/build-angular
npm error       dev @angular-devkit/build-angular@"^20.3.8" from the root project
npm error
npm error Could not resolve dependency:
npm error peer @angular/compiler@"20.3.0" from @angular/[email protected]
npm error node_modules/@angular/compiler-cli
npm error   dev @angular/compiler-cli@"20.3.0" from the root project
npm error   peer @angular/compiler-cli@"^20.0.0" from @angular-devkit/[email protected]
npm error   node_modules/@angular-devkit/build-angular
npm error     dev @angular-devkit/build-angular@"^20.3.8" from the root project
npm error   3 more (@angular/build, @angular/localize, @ngtools/webpack)
npm error
npm error Conflicting peer dependency: @angular/[email protected]
npm error node_modules/@angular/compiler
npm error   peer @angular/compiler@"20.3.0" from @angular/[email protected]
npm error   node_modules/@angular/compiler-cli
npm error     dev @angular/compiler-cli@"20.3.0" from the root project
npm error     peer @angular/compiler-cli@"^20.0.0" from @angular-devkit/[email protected]
npm error     node_modules/@angular-devkit/build-angular
npm error       dev @angular-devkit/build-angular@"^20.3.8" from the root project
npm error     3 more (@angular/build, @angular/localize, @ngtools/webpack)
npm error
npm error Fix the upstream dependency conflict, or retry
npm error this command with --force or --legacy-peer-deps
npm error to accept an incorrect (and potentially broken) dependency resolution.
npm error
npm error
npm error For a full report see:
npm error /runner/cache/others/npm/_logs/2025-12-18T07_50_23_554Z-eresolve-report.txt
npm error A complete log of this run can be found in: /runner/cache/others/npm/_logs/2025-12-18T07_50_23_554Z-debug-0.log

feat(Dependencies): Update dependency @angular/compiler to v20.3.15 […

497116f

…SECURITY] | datasource | package | from | to | | ---------- | ----------------- | ------ | ------- | | npm | @angular/compiler | 20.3.0 | 20.3.15 |

renovate bot added patch security Pull requests that address a security vulnerability labels Dec 18, 2025

renovate bot requested a review from a team December 18, 2025 07:50

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat(Dependencies): Update dependency @angular/compiler to v20.3.15 [SECURITY] #6521

feat(Dependencies): Update dependency @angular/compiler to v20.3.15 [SECURITY] #6521

Uh oh!

renovate bot commented Dec 18, 2025

Uh oh!

renovate bot commented Dec 18, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

feat(Dependencies): Update dependency @angular/compiler to v20.3.15 [SECURITY] #6521

Are you sure you want to change the base?

feat(Dependencies): Update dependency @angular/compiler to v20.3.15 [SECURITY] #6521

Uh oh!

Conversation

renovate bot commented Dec 18, 2025

GitHub Vulnerability Alerts

Impact

Patches

Attack Preconditions

Workarounds

Release Notes

compiler

http

common

compiler

core

compiler-cli

migrations

animations

compiler

compiler-cli

core

router

core

platform-browser

compiler-cli

core

migrations

router

core

migrations

compiler

core

migrations

compiler-cli

core

forms

migrations

compiler

compiler-cli

core

migrations

Configuration

Uh oh!

renovate bot commented Dec 18, 2025

⚠️ Artifact update problem

File name: package-lock.json

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant