Executive brief
Angular is a popular framework used to build web and mobile applications. A security flaw in its server-side rendering component could allow attackers to inject malicious scripts into websites. If exploited, this could lead to unauthorized actions on behalf of users, such as stealing login credentials or hijacking active sessions.
Technical details
A Cross-Site Scripting (XSS) vulnerability exists in @angular/platform-server's DOM emulation dependency (domino) during the serialization of <noscript> elements. When using Server-Side Rendering (SSR), domino treats <noscript> as a raw-text element but fails to escape closing tags (</noscript>) within bound dynamic text. An attacker can provide input containing a closing tag to break out of the <noscript> block and inject executable <script> tags. This occurs because the domino serializer omitted <noscript> from the list of elements requiring closing-tag escaping. The vulnerability is fixed in versions 22.0.0-rc.2, 21.2.16, 20.3.24, and 19.2.25.
Affected products
- Google Angular < 19.2.25, >= 19.0.0-next.0 < 19.2.25, >= 20.0.0-next.0 < 20.3.24, >= 21.0.0-next.0 < 21.2.16, >= 22.0.0-next.0 < 22.0.0-rc.2
Timeline
- 2026-05-23: disclosed: Issue first reported on GitHub
- 2026-06-02: advisory: GitHub Security Advisory published
- 2026-06-22: patched: NVD record published/updated