Angular’s Template Compiler misclassifies the href and xlink:href attributes of SVG <script> elements as unrestricted URLs. As a result, a malicious SVG file can embed arbitrary script code that will execute within the context of the page rendered by Angular. This flaw constitutes a classic script‑execution vulnerability, reflected by its assignment to CWE‑79.

The vulnerability affects Angular versions earlier than 19.2.18, 20.3.16, 21.0.7, and 21.1.0‑rc.0. Applications built with any of those releases are at risk until the framework is updated to a patched version. The issue is independent of the underlying Node.js version, as the associated CPE strings show Angular as the primary component.

The CVSS score of 8.5 indicates high severity, while the EPSS score of less than 1 % suggests a very low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Exploitability requires an attacker to supply a malicious SVG file that Angular renders; based on the description, it is inferred that the attacker would need to deliver such SVG content, typically through user‑supplied input or injection into a page that the application renders.