Executive brief
Angular's server-side rendering (SSR) component for @angular/platform-server contains a cross-site scripting vulnerability when rendering user-supplied content within nested HTML `<template>` elements inside fallback containers like `<noscript>` or `<iframe>`. The vulnerability bypasses Angular's built-in XSS protection by failing to properly escape closing tags during HTML serialization, allowing attackers to inject malicious JavaScript that executes in the browser. This affects applications that rely on Angular's SSR to safely render untrusted data without manual sanitization.
Technical details
The vulnerability is a cross-site scripting (XSS) flaw in the DOM serialization logic during SSR HTML generation. The root cause is that the serializer's ancestor traversal stops at `DocumentFragment` boundaries (which separate `<template>` content from the outer DOM per HTML5 spec) and fails to discover enclosing fallback raw-content elements like `<noscript>`, `<iframe>`, `<noembed>`, or `<noframes>`. In RAWTEXT parsing mode, these containers require inner closing tags to be escaped to prevent premature termination. When a `<template>` element is nested inside one of these containers, the serializer does not escape matching closing tags (e.g., `</noscript>`), allowing an attacker to inject such sequences via text interpolation (e.g., `{{ userInput }}`). The unescaped tag breaks out of the container when the HTML is parsed by a browser, causing subsequent attacker-controlled markup to execute as active DOM elements. No authentication is required; the attack vector is network-based and relies on passive user interaction (normal page rendering). Patches are available in Angular versions 20.3.30, 21.2.22, and 22.1.4; version 19 and earlier have no patch.
Affected products
- Google @angular/platform-server >= 22.0.0, < 22.1.4
- Google @angular/platform-server >= 21.0.0, < 21.2.22
- Google @angular/platform-server >= 20.0.0, < 20.3.30
- Google @angular/platform-server <= 19.2.25
Timeline
- 2026-09-10: disclosed: Public disclosure on GitHub Advisory Database
- 2026-08-27: patched: Patches released in Angular v20.3.30, v21.2.22, v22.1.4