Sign in
Deutsch English Español Polski
High

@angular/platform-server: Missing `<noscript>` Raw-Text Serialization Escaping leads to Cross-Site Scripting (XSS) in Angular SSR

  • Disclosed: 15.06.2026
  • Updated: 11.10.2026 10:22

A Cross-Site Scripting (XSS) vulnerability exists in @angular/platform-server's DOM emulation dependency (domino) when serializing the content of <noscript> elements.

When rendering dynamic text content inside a <noscript> element via template bindings (such as {{ value }} or [textContent]), the template engine expects the browser to render the content safely. Under Server-Side Rendering (SSR), domino is configured with scripting enabled, meaning <noscript> is treated as a raw-text element.

However, domino's serializer completely omitted <noscript> from the list of raw-text elements requiring closing-tag escaping during DOM serialization. As a result, any occurrence of </noscript> in the bound dynamic text was never escaped under any circumstances.

The unescaped closing tag was serialized directly into the output HTML (e.g. <noscript></noscript><script>alert(1)</script></noscript>). When parsed by a browser, it closes the <noscript> block early, allowing the injected <script> block to execute in the user's browser context, causing same-origin Cross-Site Scripting (XSS).

Impact

This vulnerability allows an attacker to perform same-origin Cross-Site Scripting (XSS) attacks against any user visiting an SSR-rendered page that binds user-controlled data inside a <noscript> element. This can lead to session hijacking, credentials theft, unauthorized actions on behalf of users, and defacement.

Patched Versions

  • 22.0.0-rc.2
  • 21.2.16
  • 20.3.24
  • 19.2.25

Workarounds

If you cannot immediately update your dependencies, you can:

  • Avoid binding user-controlled values inside <noscript> elements.
  • Sanitize any user input placed inside <noscript> to explicitly strip closing </noscript> tags before passing it to the template.

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
npm package @angular/platform-server >= 22.0.0-next.0, < 22.0.0-rc.2, >= 21.0.0-next.0, < 21.2.16, >= 20.0.0-next.0, < 20.3.24, >= 19.0.0-next.0, < 19.2.25, <= 18.2.14 22.0.0-rc.2, 21.2.16, 20.3.24, 19.2.25

References

CVSS score -
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Weakness (CWE)
CWE-79
Platform
npm
Package
@angular/platform-server
Disclosed
15.06.2026
Updated
11.10.2026 10:22

Sources and licenses

OSV / GitHub Advisory Database - GHSA-gxx4-3xcv-f8qx - CC BY 4.0

Vulnerability history: @angular/platform-server

All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (12) in the archive
Total entries
12
First → latest
09.2025 10.2026
Without a fix
0
Exploited in attacks
0

Severity breakdown

  • High 11
  • Medium 1

Disclosures per year

Severity:
  1. Angular SSR: Denial of Service (DoS) via Infinite Loop on Malformed DOCTYPE
    High CVE-2026-101895 >= 22.0.0, < 22.1.6, >= 21.0.0, < 21.2.23, >= 20.0.0, < 20.3.31, <= 19.2.25 22.1.6, 21.2.23, 20.3.31
  2. Angular SSR: XSS via Unescaped Processing Instruction (<?...?>) Nodes in Fallback Raw-Content Elements
    High CVE-2026-88058 >= 22.0.0, < 22.1.4, >= 21.0.0, < 21.2.22, >= 20.0.0, < 20.3.30, <= 19.2.25 22.1.4, 21.2.22, 20.3.30
  3. Angular: SSR XSS via Unescaped <template> Content Across DocumentFragment Boundaries in Fallback Raw-Content Elements
    High CVE-2026-88060 >= 22.0.0, < 22.1.4, >= 21.0.0, < 21.2.22, >= 20.0.0, < 20.3.30, <= 19.2.25 22.1.4, 21.2.22, 20.3.30
  4. Angular: SSRF and Cross-Origin Credential Disclosure via URL Resolution Discrepancy in SSR
    High CVE-2026-88056 >= 22.0.0, < 22.1.4, >= 21.0.0, < 21.2.22, >= 20.0.0, < 20.3.30, <= 19.2.25 22.1.4, 21.2.22, 20.3.30
  5. Angular SSR: Missing Fallback Raw-Content Serialization Escaping leads to Cross-Site Scripting (XSS)
    High CVE-2026-69149 >= 22.0.0-next.0, < 22.0.7, >= 21.0.0-next.0, < 21.2.19, >= 20.0.0-next.0, < 20.3.27, <= 19.2.25 22.0.7, 21.2.19, 20.3.27
  6. @angular/platform-server: Missing `<noscript>` Raw-Text Serialization Escaping leads to Cross-Site Scripting (XSS) in Angular SSR this entry
    High CVE-2026-50556 >= 22.0.0-next.0, < 22.0.0-rc.2, >= 21.0.0-next.0, < 21.2.16, >= 20.0.0-next.0, < 20.3.24, >= 19.0.0-next.0, < 19.2.25, <= 18.2.14 22.0.0-rc.2, 21.2.16, 20.3.24, 19.2.25
  7. @angular/platform-server: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
    High · 6.1 CVE-2026-50555 >= 22.0.0-next.0, < 22.0.0-rc.2, >= 21.0.0-next.0, < 21.2.16, >= 20.0.0-next.0, < 20.3.24, >= 19.0.0-next.0, < 19.2.25, <= 18.2.14 22.0.0-rc.2, 21.2.16, 20.3.24, 19.2.25
  8. @angular/platform-server: URL Parser Differential leading to SSRF Allowlist Bypass
    High · 8.2 CVE-2026-50168 >= 22.0.0-next.0, < 22.0.0-rc.2, >= 20.0.0-next.0, < 20.3.22, >= 19.0.0-next.0, < 19.2.23, <= 18.2.14, >= 21.0.0-next.0, < 21.2.15 22.0.0-rc.2, 20.3.22, 19.2.23, 21.2.15
  9. @angular/platform-server: SSRF via Hostname Hijacking
    High · 6.1 CVE-2026-46417 >= 22.0.0-next.0, < 22.0.0-next.12, >= 21.0.0-next.0, < 21.2.13, >= 20.0.0-next.0, < 20.3.21, >= 19.0.0-next.0, < 19.2.22, <= 18.2.14 22.0.0-next.12, 21.2.13, 20.3.21, 19.2.22
  10. Angular: SSRF via protocol-relative and backslash URLs in Angular Platform-Server
    High CVE-2026-41423 >= 22.0.0-next.0, < 22.0.0-next.8, >= 21.0.0-next.0, < 21.2.9, >= 20.0.0-next.0, < 20.3.19, >= 19.0.0-next.0, < 19.2.21, <= 18.2.14 22.0.0-next.8, 21.2.9, 20.3.19, 19.2.21
  11. Angular SSR: Global Platform Injector Race Condition Leads to Cross-Request Data Leakage
    High CVE-2025-59052 >= 16.0.0-next.0, < 18.2.14, >= 20.0.0-next.0, < 20.3.0, >= 19.0.0-next.0, < 19.2.15, >= 21.0.0-next.0, < 21.0.0-next.3 18.2.14, 20.3.0, 19.2.15, 21.0.0-next.3

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.