Medium6.8Red Hat Linux Updated
@angular/core: @angular/core: Cross-Site Scripting (XSS) via dynamic component creation bypass
CVE-2026-52725 Published Jun 22, 2026Updated by vendor Jun 22, 2026
Affected products & platforms
Red Hat LinuxUnclassified
Summary
@angular/core: @angular/core: Cross-Site Scripting (XSS) via dynamic component creation bypass. Red Hat rates this moderate (CVSS 6.8). Weakness: CWE-791.
Affected versions
- < 22.0.0-rc
- < 21.2.15
- < 20.3.22
- < 19.2.23
Official advisory · high-confidence parse· fetched 7 hours ago·verify at source
Fixed versions
- 22.0.0
- 21.2.15
- 20.3.22
- 19.2.23
Official advisory · high-confidence parse· fetched 7 hours ago·verify at source
Mitigation checklist
Recommended fix / mitigation
- Users of applications built with @angular/core versions prior to 19.2.23, 20.3.22, 21.2.15, or 22.0.0-rc.2 should upgrade to the fixed versions. Applications that do not use the createComponent API with user-controlled host element parameters are not exploitable.
Official advisory · high-confidence parse· fetched 7 hours ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.