GHSA-VPX6-8PJR-4G3V

Vulnerability from github – Published: 2026-08-03 16:14 – Updated: 2026-08-03 16:14
VLAI
Summary
Angular SSR: Missing Fallback Raw-Content Serialization Escaping leads to Cross-Site Scripting (XSS)
Details

A Cross-Site Scripting (XSS) vulnerability exists in @angular/platform-server's DOM emulation dependency (domino) when serializing the content of fallback raw-content elements (<iframe>, <noembed>, <noframes>, and <noscript>).

When rendering dynamic text content inside fallback raw-content elements via template bindings, the template engine expects the browser to render the content safely. Under Server-Side Rendering (SSR), domino is configured with scripting enabled, meaning these elements are treated as raw-text elements.

However, domino's serializer previously did not escape text nodes within fallback raw-content elements (<iframe>, <noembed>, <noframes>, <noscript>) during DOM serialization. As a result, any occurrence of closing tags in the bound dynamic text was not escaped.

The unescaped closing tag could be serialized directly into the output HTML. When parsed by a browser or re-parsed during SSR post-processing without preserving raw-content parser state, an injected closing tag closes the element early, allowing an injected script block to execute in the user's browser context, causing same-origin Cross-Site Scripting (XSS).

Impact

This vulnerability allows an attacker to perform same-origin Cross-Site Scripting (XSS) attacks against any user visiting an SSR-rendered page that binds user-controlled data inside fallback raw-content elements (<iframe>, <noembed>, <noframes>, <noscript>). This can lead to session hijacking, credentials theft, unauthorized actions on behalf of users, and defacement.

Patched Versions

  • 22.0.7
  • 21.2.19
  • 20.3.27

Workarounds

If you cannot immediately update your dependencies, you can mitigate this issue using any of the following approaches: - Disable critical CSS inlining: Critical CSS inlining in Angular SSR post-processes the rendered HTML using domino. Disabling this step prevents domino from re-parsing and re-serializing the HTML during server-side rendering. - In angular.json, set inlineCritical to false under style optimization options: json { "projects": { "my-app": { "architect": { "build": { "builder": "@angular/build:application", "options": { "optimization": { "styles": { "inlineCritical": false } } } } } } } } - When rendering programmatically with CommonEngine, set inlineCriticalCss: false in your render options. - Avoid binding user-controlled values inside fallback raw-content elements (<iframe>, <noembed>, <noframes>, <noscript>). - Sanitize user input placed inside these elements to explicitly strip or escape closing tags before passing it to the template.

Severity
8.6 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "@angular/platform-server"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "22.0.0-next.0"
            },
            {
              "fixed": "22.0.7"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "@angular/platform-server"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "21.0.0-next.0"
            },
            {
              "fixed": "21.2.19"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "@angular/platform-server"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "20.0.0-next.0"
            },
            {
              "fixed": "20.3.27"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "@angular/platform-server"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "19.2.25"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-69149"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-03T16:14:43Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "A Cross-Site Scripting (XSS) vulnerability exists in `@angular/platform-server`\u0027s DOM emulation dependency (`domino`) when serializing the content of fallback raw-content elements (`\u003ciframe\u003e`, `\u003cnoembed\u003e`, `\u003cnoframes\u003e`, and `\u003cnoscript\u003e`).\n\nWhen rendering dynamic text content inside fallback raw-content elements via template bindings, the template engine expects the browser to render the content safely. Under Server-Side Rendering (SSR), `domino` is configured with scripting enabled, meaning these elements are treated as raw-text elements.\n\nHowever, `domino`\u0027s serializer previously did not escape text nodes within fallback raw-content elements (`\u003ciframe\u003e`, `\u003cnoembed\u003e`, `\u003cnoframes\u003e`, `\u003cnoscript\u003e`) during DOM serialization. As a result, any occurrence of closing tags in the bound dynamic text was not escaped.\n\nThe unescaped closing tag could be serialized directly into the output HTML. When parsed by a browser or re-parsed during SSR post-processing without preserving raw-content parser state, an injected closing tag closes the element early, allowing an injected script block to execute in the user\u0027s browser context, causing same-origin Cross-Site Scripting (XSS).\n\n### Impact\n\nThis vulnerability allows an attacker to perform same-origin Cross-Site Scripting (XSS) attacks against any user visiting an SSR-rendered page that binds user-controlled data inside fallback raw-content elements (`\u003ciframe\u003e`, `\u003cnoembed\u003e`, `\u003cnoframes\u003e`, `\u003cnoscript\u003e`). This can lead to session hijacking, credentials theft, unauthorized actions on behalf of users, and defacement.\n\n### Patched Versions\n\n- 22.0.7\n- 21.2.19\n- 20.3.27\n\n### Workarounds\nIf you cannot immediately update your dependencies, you can mitigate this issue using any of the following approaches:\n- **Disable critical CSS inlining**: Critical CSS inlining in Angular SSR post-processes the rendered HTML using `domino`. Disabling this step prevents `domino` from re-parsing and re-serializing the HTML during server-side rendering.\n  - In `angular.json`, set `inlineCritical` to `false` under style optimization options:\n    ```json\n    {\n      \"projects\": {\n        \"my-app\": {\n          \"architect\": {\n            \"build\": {\n              \"builder\": \"@angular/build:application\",\n              \"options\": {\n                \"optimization\": {\n                  \"styles\": {\n                    \"inlineCritical\": false\n                  }\n                }\n              }\n            }\n          }\n        }\n      }\n    }\n    ```\n  - When rendering programmatically with `CommonEngine`, set `inlineCriticalCss: false` in your render options.\n- **Avoid binding user-controlled values** inside fallback raw-content elements (`\u003ciframe\u003e`, `\u003cnoembed\u003e`, `\u003cnoframes\u003e`, `\u003cnoscript\u003e`).\n- **Sanitize user input** placed inside these elements to explicitly strip or escape closing tags before passing it to the template.",
  "id": "GHSA-vpx6-8pjr-4g3v",
  "modified": "2026-08-03T16:14:43Z",
  "published": "2026-08-03T16:14:43Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/angular/angular/security/advisories/GHSA-vpx6-8pjr-4g3v"
    },
    {
      "type": "WEB",
      "url": "https://github.com/angular/angular/pull/69675"
    },
    {
      "type": "WEB",
      "url": "https://github.com/angular/angular/pull/69714"
    },
    {
      "type": "WEB",
      "url": "https://github.com/angular/angular/pull/69929"
    },
    {
      "type": "WEB",
      "url": "https://github.com/angular/angular/pull/69930"
    },
    {
      "type": "WEB",
      "url": "https://github.com/angular/domino/pull/32"
    },
    {
      "type": "WEB",
      "url": "https://github.com/angular/domino/commit/f88e5aa49cf2804d7c2df22ef1640eb4ec43dd56"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/angular/angular"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Angular SSR: Missing Fallback Raw-Content Serialization Escaping leads to Cross-Site Scripting (XSS)"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.