Angular.js: Prior to 22.0.0-rc.2, 21.2.16, 20.3.24, and 19.2.25, a Cross-Site Scripting (XSS) vulnerability exists in @angular/platform-server's DOM emulation… (CVE-2026-50556)

Angular's @angular/platform-server uses the domino library for DOM emulation during Server-Side Rendering. Prior to versions 22.0.0-rc.2, 21.2.16, 20.3.24, and 19.2.25, domino's serializer did not escape closing </noscript> tags within dynamic text content bound inside <noscript> elements. Since domino was configured with scripting enabled, <noscript> was treated as a raw-text element but omitted from the list requiring closing-tag escaping. This omission allowed injected </noscript> tags to prematurely close the <noscript> block, enabling subsequent injected <script> tags to execute, resulting in a same-origin XSS vulnerability. The issue is resolved in the specified fixed versions.

Successful exploitation allows an attacker to inject and execute arbitrary JavaScript in the context of the affected web application, leading to potential compromise of user data confidentiality and integrity. The vulnerability has a CVSS 3.1 score of 8.1 (high severity), indicating a significant risk if exploited. No known exploits are reported in the wild at this time.

Upgrade Angular to one of the fixed versions: 22.0.0-rc.2, 21.2.16, 20.3.24, or 19.2.25. These versions include the fix that properly escapes closing </noscript> tags during DOM serialization in @angular/platform-server. No additional mitigation is required once upgraded.