Executive brief
Angular's server-side rendering (SSR) module can improperly serialize DOM nodes when building web applications, leaving attacker-controlled content unescaped. This allows an attacker to inject malicious JavaScript that executes in a user's browser, potentially stealing session data, modifying page content, or performing actions on behalf of the victim.
Technical details
The vulnerability is a cross-site scripting (XSS) flaw in Angular's @angular/platform-server module. When serializing ProcessingInstruction DOM nodes within fallback raw-content elements (such as noscript, iframe, noembed, or noframes), the module fails to properly escape less-than characters and does not inspect parent closing tags. An attacker can inject a ProcessingInstruction with matching closing tag data via inject(DOCUMENT).createProcessingInstruction() or Renderer2 DOM insertion, which prematurely closes the fallback container in HTML5 RAWTEXT parsing mode. This causes subsequent sibling elements to be interpreted as executable HTML, enabling arbitrary JavaScript execution. The issue requires application code to explicitly use createProcessingInstruction with attacker-controlled input. The vulnerability is fixed in Angular 20.3.30, 21.2.22, and 22.1.4.
Affected products
- Google Angular Prior to 20.3.30, 21.2.22, and 22.1.4
Timeline
- 2026-09-10: disclosed
- 2026-09-10: patched: Angular 20.3.30, 21.2.22, and 22.1.4 include fixes