GHSA-GXX4-3XCV-F8QX
Vulnerability from github – Published: 2026-06-15 17:21 – Updated: 2026-06-15 17:21A Cross-Site Scripting (XSS) vulnerability exists in @angular/platform-server's DOM emulation dependency (domino) when serializing the content of <noscript> elements.
When rendering dynamic text content inside a <noscript> element via template bindings (such as {{ value }} or [textContent]), the template engine expects the browser to render the content safely. Under Server-Side Rendering (SSR), domino is configured with scripting enabled, meaning <noscript> is treated as a raw-text element.
However, domino's serializer completely omitted <noscript> from the list of raw-text elements requiring closing-tag escaping during DOM serialization. As a result, any occurrence of </noscript> in the bound dynamic text was never escaped under any circumstances.
The unescaped closing tag was serialized directly into the output HTML (e.g. <noscript></noscript><script>alert(1)</script></noscript>). When parsed by a browser, it closes the <noscript> block early, allowing the injected <script> block to execute in the user's browser context, causing same-origin Cross-Site Scripting (XSS).
Impact
This vulnerability allows an attacker to perform same-origin Cross-Site Scripting (XSS) attacks against any user visiting an SSR-rendered page that binds user-controlled data inside a <noscript> element. This can lead to session hijacking, credentials theft, unauthorized actions on behalf of users, and defacement.
Patched Versions
- 22.0.0-rc.2
- 21.2.16
- 20.3.24
- 19.2.25
Workarounds
If you cannot immediately update your dependencies, you can:
- Avoid binding user-controlled values inside
<noscript>elements. - Sanitize any user input placed inside
<noscript>to explicitly strip closing</noscript>tags before passing it to the template.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "@angular/platform-server"
},
"ranges": [
{
"events": [
{
"introduced": "22.0.0-next.0"
},
{
"fixed": "22.0.0-rc.2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "@angular/platform-server"
},
"ranges": [
{
"events": [
{
"introduced": "21.0.0-next.0"
},
{
"fixed": "21.2.16"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "@angular/platform-server"
},
"ranges": [
{
"events": [
{
"introduced": "20.0.0-next.0"
},
{
"fixed": "20.3.24"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "@angular/platform-server"
},
"ranges": [
{
"events": [
{
"introduced": "19.0.0-next.0"
},
{
"fixed": "19.2.25"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "@angular/platform-server"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "18.2.14"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-50556"
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"github_reviewed": true,
"github_reviewed_at": "2026-06-15T17:21:03Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "A Cross-Site Scripting (XSS) vulnerability exists in `@angular/platform-server`\u0027s DOM emulation dependency (`domino`) when serializing the content of `\u003cnoscript\u003e` elements.\n\nWhen rendering dynamic text content inside a `\u003cnoscript\u003e` element via template bindings (such as `{{ value }}` or `[textContent]`), the template engine expects the browser to render the content safely. Under Server-Side Rendering (SSR), `domino` is configured with scripting enabled, meaning `\u003cnoscript\u003e` is treated as a raw-text element.\n\nHowever, `domino`\u0027s serializer completely omitted `\u003cnoscript\u003e` from the list of raw-text elements requiring closing-tag escaping during DOM serialization. As a result, any occurrence of `\u003c/noscript\u003e` in the bound dynamic text was **never escaped under any circumstances**.\n\nThe unescaped closing tag was serialized directly into the output HTML (e.g. `\u003cnoscript\u003e\u003c/noscript\u003e\u003cscript\u003ealert(1)\u003c/script\u003e\u003c/noscript\u003e`). When parsed by a browser, it closes the `\u003cnoscript\u003e` block early, allowing the injected `\u003cscript\u003e` block to execute in the user\u0027s browser context, causing same-origin Cross-Site Scripting (XSS).\n\n### Impact\n\nThis vulnerability allows an attacker to perform same-origin Cross-Site Scripting (XSS) attacks against any user visiting an SSR-rendered page that binds user-controlled data inside a `\u003cnoscript\u003e` element. This can lead to session hijacking, credentials theft, unauthorized actions on behalf of users, and defacement.\n\n### Patched Versions\n\n- 22.0.0-rc.2\n- 21.2.16\n- 20.3.24\n- 19.2.25\n\n### Workarounds\n\nIf you cannot immediately update your dependencies, you can:\n\n- Avoid binding user-controlled values inside `\u003cnoscript\u003e` elements.\n- Sanitize any user input placed inside `\u003cnoscript\u003e` to explicitly strip closing `\u003c/noscript\u003e` tags before passing it to the template.",
"id": "GHSA-gxx4-3xcv-f8qx",
"modified": "2026-06-15T17:21:03Z",
"published": "2026-06-15T17:21:03Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/angular/angular/security/advisories/GHSA-gxx4-3xcv-f8qx"
},
{
"type": "WEB",
"url": "https://github.com/angular/angular/issues/68903"
},
{
"type": "WEB",
"url": "https://github.com/angular/domino/pull/29"
},
{
"type": "PACKAGE",
"url": "https://github.com/angular/angular"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "@angular/platform-server: Missing `\u003cnoscript\u003e` Raw-Text Serialization Escaping leads to Cross-Site Scripting (XSS) in Angular SSR"
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.