Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to versions 19.2.16, 20.3.14, and 21.0.1, there is a XSRF token leakage via protocol-relative URLs in angular HTTP clients. The vulnerability is a Credential Leak by App Logic that leads to the unauthorized disclosure of the Cross-Site Request Forgery (XSRF) token to an attacker-controlled domain. Angular's HttpClient has a built-in XSRF protection mechanism that works by checking if a request URL starts with a protocol (http:// or https://) to determine if it is cross-origin. If the URL starts with protocol-relative URL (//), it is incorrectly treated as a same-origin request, and the XSRF token is automatically added to the X-XSRF-TOKEN header. This issue has been patched in versions 19.2.16, 20.3.14, and 21.0.1. A workaround for this issue involves avoiding using protocol-relative URLs (URLs starting with //) in HttpClient requests. All backend communication URLs should be hardcoded as relative paths (starting with a single /) or fully qualified, trusted absolute URLs.

According to its self-reported version number, Angular is prior to 19.0.0, 19.x prior to 19.2.16, 20.x prior to 20.3.14 or 21.x prior to 21.0.1. It is, therefore, affected by an XSRF token leakage vulnerability in the HttpClient of @angular/common. Protocol-relative URLs (starting with //) are treated as same-origin requests, causing the XSRF token to be sent to an attacker-controlled domain and allowing Cross-Site Request Forgery (CSRF) attacks. (CVE-2025-66035)

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to versions 19.2.16, 20.3.14, and 21.0.1, there is a XSRF token leakage via protocol-relative URLs in angular HTTP clients. The vulnerability is a Credential Leak by App Logic that leads to the unauthorized disclosure of the Cross-Site Request Forgery (XSRF) token to an attacker-controlled domain. Angular's HttpClient has a built-in XSRF protection mechanism that works by checking if a request URL starts with a protocol (http:// or https://) to determine if it is cross- origin. If the URL starts with protocol-relative URL (//), it is incorrectly treated as a same-origin request, and the XSRF token is automatically added to the X-XSRF-TOKEN header. This issue has been patched in versions 19.2.16, 20.3.14, and 21.0.1. A workaround for this issue involves avoiding using protocol-relative URLs (URLs starting with //) in HttpClient requests. All backend communication URLs should be hardcoded as relative paths (starting with a single /) or fully qualified, trusted absolute URLs.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Angular is a development platform for building mobile and desktop web applications using
    TypeScript/JavaScript and other languages. Prior to versions 19.2.16, 20.3.14, and 21.0.1, there is a XSRF
    token leakage via protocol-relative URLs in angular HTTP clients. The vulnerability is a Credential Leak
    by App Logic that leads to the unauthorized disclosure of the Cross-Site Request Forgery (XSRF) token to
    an attacker-controlled domain. Angular's HttpClient has a built-in XSRF protection mechanism that works by
    checking if a request URL starts with a protocol (http:// or https://) to determine if it is cross-origin.
    If the URL starts with protocol-relative URL (//), it is incorrectly treated as a same-origin request, and
    the XSRF token is automatically added to the X-XSRF-TOKEN header. This issue has been patched in versions
    19.2.16, 20.3.14, and 21.0.1. A workaround for this issue involves avoiding using protocol-relative URLs
    (URLs starting with //) in HttpClient requests. All backend communication URLs should be hardcoded as
    relative paths (starting with a single /) or fully qualified, trusted absolute URLs. (CVE-2025-66035)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Angular is a development platform for building mobile and desktop web applications using     TypeScript/JavaScript and other languages. Prior to versions 19.2.16, 20.3.14, and 21.0.1, there is a XSRF     token leakage via protocol-relative URLs in angular HTTP clients. The vulnerability is a Credential Leak     by App Logic that leads to the unauthorized disclosure of the Cross-Site Request Forgery (XSRF) token to     an attacker-controlled domain. Angular's HttpClient has a built-in XSRF protection mechanism that works by     checking if a request URL starts with a protocol (http:// or https://) to determine if it is cross-origin.
    If the URL starts with protocol-relative URL (//), it is incorrectly treated as a same-origin request, and     the XSRF token is automatically added to the X-XSRF-TOKEN header. This issue has been patched in versions     19.2.16, 20.3.14, and 21.0.1. A workaround for this issue involves avoiding using protocol-relative URLs     (URLs starting with //) in HttpClient requests. All backend communication URLs should be hardcoded as     relative paths (starting with a single /) or fully qualified, trusted absolute URLs. (CVE-2025-66035)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
115636	Angular < 19.2.16 XSRF Token Leakage	Web App Scanning	Component Vulnerability	Version Based	high
115635	Angular 19.x < 19.2.16 XSRF Token Leakage	Web App Scanning	Component Vulnerability	Version Based	high
115634	Angular 20.x < 20.3.14 XSRF Token Leakage	Web App Scanning	Component Vulnerability	Version Based	high
115633	Angular 21.x < 21.0.1 XSRF Token Leakage	Web App Scanning	Component Vulnerability	Version Based	high
505434	Siemens RUGGEDCOM RST2428P Insertion of Sensitive Information Into Sent Data (CVE-2025-66035)	Tenable OT Security	Tenable.ot	Remote	high
436963	SCA: security update for @angular/common (GHSA-58c5-g7wp-6w37)	Tenable Cloud Security	SCA Checks	Local	high
436963	SCA: security update for @angular/common (GHSA-58c5-g7wp-6w37)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
276979	Linux Distros Unpatched Vulnerability : CVE-2025-66035	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2025-66035

high

Tenable Plugins

high

high

high

high

high

high

high

high