CVE-2025-66035

🗓️ 05 Dec 2025 17:25:34Reported by redhat.comType

redhatcve🔗 access.redhat.com👁 9 Views

XSRF token leakage via protocol-relative URLs in Angular HttpClient; patched in 19.2.16, 20.3.14, 21.0.1.

Reporter	Title	Published	Views	Family All 102
IBM Security Bulletins	Security Bulletin: IBM Storage Protect Client is vulnerable to cross-site request forgery token leakage due to Angular (CVE-2025-66035)	31 Jul 202617:28	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Netty,node.js,spring-cloud-gateway-server,Angular,Picomatch,nanoid,spring-security,form-data,Apache Log4j Core,brace-expansion might affect IBM Storage Defender Copy Data Management	30 Sep 202617:09	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities related to Angular and JJWT have been fixed in IBM Informix HQ 3.2.2.	27 Apr 202606:31	–	ibm
IBM Security Bulletins	Security Bulletin: common-18.2.14.tgz, IBM Sterling Connect:Direct Web Services is affected by Credential Leak by App Logic that leads to the unauthorized disclosure.	2 Jun 202611:50	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Storage Protect for Space Management is vulnerable to cross-site request forgery token leakage due to Angular (CVE-2025-66035)	31 Jul 202617:32	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Db2 Mirror for i is vulnerable to cross-site scripting and cross-site request forgery due to Angular [CVE-2025-66412, CVE-2026-22610, CVE-2025-66035]	20 Feb 202616:54	–	ibm
IBM Security Bulletins	Security Bulletin: IBM i is affected by Cross-Site Request Forgery and Cross-Site Scripting in Digital Certificate Manager and Navigator for i [CVE-2025-66035, CVE-2025-66412, CVE-2026-22610]	20 Feb 202616:42	–	ibm
Chainguard	CVE-2025-66035 vulnerabilities	2 Jul 202620:22	–	cgr
Circl	CVE-2025-66035	26 Nov 202523:17	–	circl
CNNVD	Angular 安全漏洞	26 Nov 202500:00	–	cnnvd

Source	Link
cve	www.cve.org/CVERecord
nvd	www.nvd.nist.gov/vuln/detail/CVE-2025-66035
github	www.github.com/angular/angular/commit/0276479e7d0e280e0f8d26fa567d3b7aa97a516f
github	www.github.com/angular/angular/commit/05fe6686a97fa0bcd3cf157805b3612033f975bc
github	www.github.com/angular/angular/commit/3240d856d942727372a705252f7c8c115394a41e
github	www.github.com/angular/angular/releases/tag/19.2.16
github	www.github.com/angular/angular/releases/tag/20.3.14
github	www.github.com/angular/angular/releases/tag/21.0.1
github	www.github.com/angular/angular/security/advisories/GHSA-58c5-g7wp-6w37
bugzilla	www.bugzilla.redhat.com/show_bug.cgi

16 Dec 2025 17:01Current

6Medium risk

Vulners AI Score6

CVSS 47.7

CVSS 3.17.1

EPSS0.00659

SSVC

CWE-201 CWE-359

cross site forgery angular framework protocol relative web client