Executive brief
A security vulnerability exists in the Angular web development framework when using Server-Side Rendering (SSR). An attacker can bypass security filters by using specific Unicode characters (like emojis) to inject malicious scripts into a website. If successful, this could allow the attacker to steal user sessions, hijack accounts, or deface the website for any visitor.
Technical details
A Cross-Site Scripting (XSS) vulnerability exists in @angular/platform-server's DOM emulation dependency, domino, during the serialization of raw-text elements like <script>, <style>, and <iframe>. The root cause is a Unicode index alignment bug where astral characters (such as emojis) occupy two UTF-16 code units, causing an offset shift in domino's replacement logic. This misalignment prevents the library from correctly escaping closing tags in dynamic text. An attacker can exploit this by providing a payload containing astral characters followed by a closing tag (e.g., 😀</iframe><script>alert(1)</script>), which breaks out of the raw-text context during Server-Side Rendering (SSR) and executes arbitrary JavaScript in the victim's browser. The issue is fixed in Angular versions 22.0.0-rc.2, 21.2.16, 20.3.24, and 19.2.25.
Affected products
- Google Angular < 19.2.25, >= 19.0.0-next.0 < 19.2.25, >= 20.0.0-next.0 < 20.3.24, >= 21.0.0-next.0 < 21.2.16, >= 22.0.0-next.0 < 22.0.0-rc.2
Timeline
- 2026-05-26: patched: Fix merged in domino dependency
- 2026-06-02: advisory: GitHub Security Advisory published
- 2026-06-22: disclosed: CVE published to NVD