Angular contains a Cross-site Scripting (XSS) vulnerability that permits attackers to execute malicious code within the user's browser.

This is a Cross-site Scripting (CWE-79) vulnerability occurring within the Angular compiler and core. The attack is unauthenticated and requires user interaction, potentially allowing an attacker to manipulate the rendered content of the application.

The CVSS score of 7.6 reflects a high risk to application security. Successful exploitation allows for the execution of malicious scripts in the victim's browser, which can lead to the exfiltration of sensitive information, such as authentication tokens or personal user data, resulting in both financial and reputational harm.

Immediate Action: Update the @angular/compiler and @angular/core packages to version 20.3.27, 21.2.19, or 22.0.1.

Proactive Monitoring: Use browser-based security tools to detect unauthorized script execution and monitor application logs for anomalous patterns.

Compensating Controls: Utilize a Web Application Firewall (WAF) to filter out malicious input patterns that could trigger the XSS vulnerability until the update is applied.

Public Exploit Available: Unknown

Given the central role of the Angular core and compiler in application functionality, this update is critical for maintaining a secure posture. Administrators should schedule the deployment of these patches immediately to protect users from potential client-side attacks.