Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23, an issue in the @angular/core package allows bypassing script-execution restrictions during dynamic component creation. Specifically, the dynamic component instantiation mechanism (createComponent) failed to reject mounting components directly onto a <script> or namespaced script element (such as <svg:script>). This enabled the initialization of custom components on a tag that executes scripts, allowing attackers to hijack or inject script-executing hosts. This flaw enables an attacker who can control the host element or selector parameter passed to createComponent to initialize or mount an Angular component directly onto a <script> tag, leading to execution of untrusted code or client-side Cross-Site Scripting (XSS). This vulnerability is fixed in 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Angular is a development platform for building mobile and desktop web applications using     TypeScript/JavaScript and other languages. Prior to 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23, an issue     in the @angular/core package allows bypassing script-execution restrictions during dynamic component     creation. Specifically, the dynamic component instantiation mechanism (createComponent) failed to reject     mounting components directly onto a <script> or namespaced script element (such as <svg:script>). This     enabled the initialization of custom components on a tag that executes scripts, allowing attackers to     hijack or inject script-executing hosts. This flaw enables an attacker who can control the host element or     selector parameter passed to createComponent to initialize or mount an Angular component directly onto a     <script> tag, leading to execution of untrusted code or client-side Cross-Site Scripting (XSS). This     vulnerability is fixed in 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23. (CVE-2026-52725)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Angular is a development platform for building mobile and desktop web applications using
    TypeScript/JavaScript and other languages. Prior to 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23, an issue
    in the @angular/core package allows bypassing script-execution restrictions during dynamic component
    creation. Specifically, the dynamic component instantiation mechanism (createComponent) failed to reject
    mounting components directly onto a <script> or namespaced script element (such as <svg:script>). This
    enabled the initialization of custom components on a tag that executes scripts, allowing attackers to
    hijack or inject script-executing hosts. This flaw enables an attacker who can control the host element or
    selector parameter passed to createComponent to initialize or mount an Angular component directly onto a
    <script> tag, leading to execution of untrusted code or client-side Cross-Site Scripting (XSS). This
    vulnerability is fixed in 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23. (CVE-2026-52725)

ID	Name	Product	Family	Severity
322240	Linux Distros Unpatched Vulnerability : CVE-2026-52725	Nessus	Misc.	medium
443211	SCA: security update for @angular/core (GHSA-692r-grfm-v8x7)	Tenable Cloud Security	SCA Checks	medium
443211	SCA: security update for @angular/core (GHSA-692r-grfm-v8x7)	Tenable Self-Hosted Container Security	SCA Checks	medium

Detections

Analytics

CVE-2026-52725

medium

Tenable Plugins

medium

medium

medium