# Angular Universal critical CSS inlining cross-site scripting

Source: https://junglewise.ai/threats/angular-universal-critical-css-inlining-cross-site-scripting-3aadc71e  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2023-08-09. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

Severity: info · CVSS 7.1 · Published 2023-08-09

Angular Universal is a server-side rendering framework for Angular applications. Versions 16.1.0 and 16.1.1 contain a cross-site scripting (XSS) vulnerability in their critical CSS inlining feature that allows attackers to inject malicious JavaScript code into web pages, potentially compromising user sessions or stealing sensitive data.

Technologies: [@nguniversal/common (npm)](https://junglewise.ai/threats/technologies/nguniversal-common). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Informational severity, with a CVSS score of 7.1, published 9 August 2023.

**Which products and versions are affected?** @nguniversal/common (npm) SEMVER:introduced=16.1.0,fixed=16.1.2.

**Is there a fix for This vulnerability?** Yes. @nguniversal/common (npm): upgrade to 16.1.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked over the network.

**Am I affected?** Check whether you run @nguniversal/common (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @nguniversal/common (npm): upgrade to 16.1.2 or later

  ```sh
  npm install @nguniversal/common@16.1.2
  ```


## Technical details

The vulnerability is a reflected/stored XSS (CWE-79, CWE-116) in Angular Universal's critical CSS inlining feature, affecting versions 16.1.0–16.1.1. The root cause is improper neutralization of script-related HTML tags and inadequate output encoding when inlining critical CSS. An attacker can craft a malicious URL or modify page content to inject JavaScript that executes in the browser context of other users. The attack requires network access and users visiting an attacker-controlled or compromised page. The vulnerability is patched in version 16.1.2 and higher (including 16.2.0-rc.0); users can also downgrade to 16.0.x or override the critters dependency to version 0.0.20.

## Affected products

- Angular @nguniversal/common 16.1.0 to 16.1.1

## Timeline

- 2023-08-09: disclosed
- 2023-08-09: patched: Version 16.1.2 released with patch

## References

- [https://github.com/angular/universal/security/advisories/GHSA-r3hf-q8q7-fv2p](https://github.com/angular/universal/security/advisories/GHSA-r3hf-q8q7-fv2p)
- [https://github.com/angular/universal](https://github.com/angular/universal)

## Related threats

- [Angular SSR SSRF and header injection in request handling](https://junglewise.ai/threats/cve-2026-27739-angular-ssr-ssrf-and-header-injection-in-request-handling)
- [Angular Server-Side Rendering race condition in platform injector](https://junglewise.ai/threats/cve-2025-59052-angular-server-side-rendering-race-condition-in-platform-injector)