Skip to content

Defs tags inside svg are stripped after updating to Angular v20.3.22 #68977

@KristofGilis

Description

@KristofGilis

Which @angular/* package(s) are the source of the bug?

compiler

Is this a regression?

No

Description

After updating my application to the latest v20 version (v20.3.22). I see that the icons inside my application are not rendered correctly anymore.

While debugging I see that the style tag inside are gone.

This is the actual svg that is implemented in my application's code:

<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 16 16">
    <g transform="matrix(0.6666666666666666,0,0,0.6666666666666666,0,0)">
      <defs>
        <style>
          .a {
            fill: none;
            stroke: currentColor;
            stroke-linecap: round;
            stroke-linejoin: round;
          }
        </style>
      </defs>
      <rect class="a" x="0.5" y="2.501" width="23" height="21" rx="1" ry="1"></rect>
      <line class="a" x1="5.5" y1="0.501" x2="5.5" y2="5.501"></line>
      <line class="a" x1="18.5" y1="0.501" x2="18.5" y2="5.501"></line>
      <line class="a" x1="0.5" y1="7.501" x2="23.5" y2="7.501"></line>
    </g>
  </svg>

When viewing the elements inside my devtools I see this:

<svg _ngcontent-ng-c796660766="" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 16 16">
    <g _ngcontent-ng-c796660766="" transform="matrix(0.6666666666666666,0,0,0.6666666666666666,0,0)">
        <defs _ngcontent-ng-c796660766=""></defs>
        <rect _ngcontent-ng-c796660766="" x="0.5" y="2.501" width="23" height="21" rx="1" ry="1"
            class="a"></rect>
        <line _ngcontent-ng-c796660766="" x1="5.5" y1="0.501" x2="5.5" y2="5.501" class="a"></line>
        <line _ngcontent-ng-c796660766="" x1="18.5" y1="0.501" x2="18.5" y2="5.501" class="a"></line>
        <line _ngcontent-ng-c796660766="" x1="0.5" y1="7.501" x2="23.5" y2="7.501" class="a"></line>
    </g>
</svg>

Please provide the environment you discovered this bug in (run ng version)

Angular CLI: 20.3.26
Node: 24.13.1
Package Manager: npm 11.12.1
OS: win32 x64
    

Angular: 20.3.22
... animations, common, compiler, compiler-cli, core, forms
... platform-browser, platform-browser-dynamic, router
... service-worker

Package                      Version
------------------------------------
@angular-devkit/architect    0.2003.26
@angular-devkit/core         20.3.26
@angular-devkit/schematics   20.3.26
@angular/build               20.3.26
@angular/cdk                 20.2.14
@angular/cli                 20.3.26
@angular/material            20.2.14
@schematics/angular          20.3.26
rxjs                         7.8.2
typescript                   5.8.3
zone.js                      0.15.1

Metadata

Metadata

Assignees

Labels

area: securityIssues related to built-in security features, such as HTML sanitationregressionIndicates than the issue relates to something that worked in a previous versionstate: has PR

Type

No type
No fields configured for issues without a type.

Projects

No projects

Relationships

None yet

Development

No branches or pull requests

Issue actions