Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-j1ye-vncb-e7bg
Vulnerability ID VCID-j1ye-vncb-e7bg
Aliases CVE-2025-62427
GHSA-q63q-pgmf-mxhr
Summary Angular SSR has a Server-Side Request Forgery (SSRF) flaw The vulnerability is a **Server-Side Request Forgery (SSRF)** flaw within the URL resolution mechanism of Angular's Server-Side Rendering package (`@angular/ssr`). The function `createRequestUrl` uses the native `URL` constructor. When an incoming request path (e.g., `originalUrl` or `url`) begins with a **double forward slash (`//`) or backslash (`\\`)**, the `URL` constructor treats it as a **schema-relative URL**. This behavior overrides the security-intended base URL (protocol, host, and port) supplied as the second argument, instead resolving the URL against the scheme of the base URL but adopting the attacker-controlled hostname. This allows an attacker to specify an external domain in the URL path, tricking the Angular SSR environment into setting the page's virtual location (accessible via `DOCUMENT` or `PlatformLocation` tokens) to this attacker-controlled domain. Any subsequent **relative HTTP requests** made during the SSR process (e.g., using `HttpClient.get('assets/data.json')`) will be incorrectly resolved against the attacker's domain, forcing the server to communicate with an arbitrary external endpoint.
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-918 Server-Side Request Forgery (SSRF)
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.00068 https://api.first.org/data/v1/epss?cve=CVE-2025-62427
epss 0.00068 https://api.first.org/data/v1/epss?cve=CVE-2025-62427
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-q63q-pgmf-mxhr
cvssv4 8.7 https://github.com/angular/angular-cli
generic_textual HIGH https://github.com/angular/angular-cli
cvssv4 8.7 https://github.com/angular/angular-cli/commit/5271547c80662de10cb3bcb648779a83f6efedfb
generic_textual HIGH https://github.com/angular/angular-cli/commit/5271547c80662de10cb3bcb648779a83f6efedfb
ssvc Track https://github.com/angular/angular-cli/commit/5271547c80662de10cb3bcb648779a83f6efedfb
cvssv3.1_qr HIGH https://github.com/angular/angular-cli/security/advisories/GHSA-q63q-pgmf-mxhr
cvssv4 8.7 https://github.com/angular/angular-cli/security/advisories/GHSA-q63q-pgmf-mxhr
generic_textual HIGH https://github.com/angular/angular-cli/security/advisories/GHSA-q63q-pgmf-mxhr
ssvc Track https://github.com/angular/angular-cli/security/advisories/GHSA-q63q-pgmf-mxhr
cvssv4 8.7 https://nvd.nist.gov/vuln/detail/CVE-2025-62427
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2025-62427
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2025-62427
https://github.com/angular/angular-cli
https://github.com/angular/angular-cli/commit/5271547c80662de10cb3bcb648779a83f6efedfb
CVE-2025-62427 https://nvd.nist.gov/vuln/detail/CVE-2025-62427
GHSA-q63q-pgmf-mxhr https://github.com/advisories/GHSA-q63q-pgmf-mxhr
GHSA-q63q-pgmf-mxhr https://github.com/angular/angular-cli/security/advisories/GHSA-q63q-pgmf-mxhr
No exploits are available.
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N Found at https://github.com/angular/angular-cli
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N Found at https://github.com/angular/angular-cli/commit/5271547c80662de10cb3bcb648779a83f6efedfb
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-10-16T19:33:05Z/ Found at https://github.com/angular/angular-cli/commit/5271547c80662de10cb3bcb648779a83f6efedfb
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N Found at https://github.com/angular/angular-cli/security/advisories/GHSA-q63q-pgmf-mxhr
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-10-16T19:33:05Z/ Found at https://github.com/angular/angular-cli/security/advisories/GHSA-q63q-pgmf-mxhr
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N Found at https://nvd.nist.gov/vuln/detail/CVE-2025-62427
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.21325
EPSS Score 0.00068
Published At June 5, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-02T04:48:10.719805+00:00 GitLab Importer Import https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/@angular/ssr/CVE-2025-62427.yml 38.6.0