Vulnerability · Published Nov 26, 2025 · Assigned by GitHub_M
CVE-2025-66035Angular HTTP Client Has XSRF Token Leakage via Protocol-Relative URLs
High 7.7
In plain English
A high-severity security flaw in angular from angular. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 54% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to versions 19.2.16, 20.3.14, and 21.0.1, there is a XSRF token leakage via protocol-relative URLs in angular HTTP clients. The vulnerability is a Credential Leak by App Logic that leads to the unauthorized disclosure of the Cross-Site Request Forgery (XSRF) token to an attacker-controlled domain. Angular's HttpClient has a built-in XSRF protection mechanism that works by checking if a request URL starts with a protocol (http:// or https://) to determine if it is cross-origin. If the URL starts with protocol-relative URL (//), it is incorrectly treated as a same-origin request, and the XSRF token is automatically added to the X-XSRF-TOKEN header. This issue has been patched in versions 19.2.16, 20.3.14, and 21.0.1. A workaround for this issue involves avoiding using protocol-relative URLs (URLs starting with //) in HttpClient requests. All backend communication URLs should be hardcoded as relative paths (starting with a single /) or fully qualified, trusted absolute URLs.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | angular.js | no fix listed | DEBIAN-CVE-2025-66035 |
| Debian:13 | angular.js | no fix listed | DEBIAN-CVE-2025-66035 |
| Debian:14 | angular.js | no fix listed | DEBIAN-CVE-2025-66035 |
| Ubuntu:22.04:LTS | angular.js | no fix listed | UBUNTU-CVE-2025-66035 |
| Ubuntu:24.04:LTS | angular.js | no fix listed | UBUNTU-CVE-2025-66035 |
| Ubuntu:25.10 | angular.js | no fix listed | UBUNTU-CVE-2025-66035 |
| Ubuntu:26.04:LTS | angular.js | no fix listed | UBUNTU-CVE-2025-66035 |
| Ubuntu:26.10 | angular.js | no fix listed | UBUNTU-CVE-2025-66035 |
| npm | @angular/common | 19.2.16 | GHSA-58c5-g7wp-6w37 |
| npm | @angular/common | 20.3.14 | GHSA-58c5-g7wp-6w37 |
| npm | @angular/common | 21.0.1 | GHSA-58c5-g7wp-6w37 |
Affected products (as reported)
Weakness: CWE-201, CWE-359 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N
References
- https://github.com/angular/angular/security/advisories/GHSA-58c5-g7wp-6w37 x_refsource_CONFIRM
- https://github.com/angular/angular/commit/0276479e7d0e280e0f8d26fa567d3b7aa97a516f x_refsource_MISC
- https://github.com/angular/angular/commit/05fe6686a97fa0bcd3cf157805b3612033f975bc x_refsource_MISC
- https://github.com/angular/angular/commit/3240d856d942727372a705252f7c8c115394a41e x_refsource_MISC
- https://github.com/angular/angular/releases/tag/19.2.16 x_refsource_MISC
- https://github.com/angular/angular/releases/tag/20.3.14 x_refsource_MISC
- https://github.com/angular/angular/releases/tag/21.0.1 x_refsource_MISC
- https://cert-portal.siemens.com/productcert/html/ssa-485750.html
- https://cert-portal.siemens.com/productcert/html/ssa-253495.html