The vulnerability (CVE-2026-69149) affects @angular/platform-server versions up to 19.2.25 due to improper escaping of closing tags in fallback raw-content elements during SSR by the domino library. This flaw allows an attacker to inject malicious scripts via dynamic text content bound inside elements like <iframe>, <noembed>, <noframes>, and <noscript>. When the server-side rendered HTML is parsed by browsers or re-parsed during SSR post-processing, the injected closing tags can prematurely terminate these elements and enable script execution in the user's browser context, resulting in same-origin Cross-Site Scripting (XSS). This can lead to session hijacking, credential theft, unauthorized actions, and defacement. The issue is patched in versions 22.0.7, 21.2.19, and 20.3.27 of @angular/platform-server. Mitigations include disabling critical CSS inlining to prevent domino from re-parsing HTML, avoiding user-controlled bindings inside affected elements, or sanitizing inputs to escape or remove closing tags.

This vulnerability enables attackers to perform same-origin Cross-Site Scripting (XSS) attacks on users visiting SSR-rendered pages that bind user-controlled data inside fallback raw-content elements. Exploitation can result in session hijacking, theft of credentials, unauthorized actions performed on behalf of users, and website defacement. The vulnerability affects server-side rendered Angular applications using vulnerable versions of @angular/platform-server and can compromise the security of affected web applications and their users.

A fix is available in @angular/platform-server versions 22.0.7, 21.2.19, and 20.3.27. Users should update to one of these patched versions to remediate the vulnerability. If immediate updating is not possible, mitigations include disabling critical CSS inlining in Angular SSR post-processing to prevent domino from re-parsing and re-serializing HTML, avoiding binding user-controlled data inside fallback raw-content elements (<iframe>, <noembed>, <noframes>, <noscript>), and sanitizing user inputs to strip or escape closing tags before rendering. These mitigations reduce the risk of exploitation until the patch can be applied.