The vulnerability in @angular/platform-server arises from its DOM emulation dependency domino's improper escaping of raw-text elements during serialization. Due to a Unicode index alignment bug related to UTF-16 code unit counting of astral characters, the replacement logic miscalculates offsets and fails to escape closing tags such as </script>, </style>, or </iframe>. This failure allows an attacker who controls dynamic text containing astral characters and closing tags to break out of raw-text contexts and inject executable script blocks during SSR. This results in same-origin Cross-Site Scripting (XSS) attacks against users of SSR-rendered pages that bind user-controlled data inside raw-text elements. The vulnerability affects versions up to and including 18.2.14 and is fixed in versions 19.2.25 and later.

This vulnerability enables attackers to execute arbitrary JavaScript in the context of the affected web application by injecting malicious scripts through user-controlled input bound inside raw-text elements during server-side rendering. The impact includes session hijacking, credential theft, unauthorized actions on behalf of users, and potential defacement of web pages. The vulnerability is classified as high severity due to the potential for significant compromise of user security and application integrity.

A fix is available in @angular/platform-server versions 19.2.25, 20.3.24, 21.2.16, and 22.0.0-rc.2. Users should upgrade to one of these patched versions to remediate the vulnerability. If immediate upgrading is not possible, avoid binding user-controlled input inside raw-text elements such as <iframe>, <script>, or <style>. Additionally, sanitize any user input placed inside these elements to explicitly remove closing tags before rendering to prevent injection of executable code.