Platform server: Angular SSR: Missing Fallback Raw-Content Serialization Escaping leads to Cross-Site Scripting (XSS) (CVE-2026-69149)
A Cross-Site Scripting (XSS) vulnerability exists in @angular/platform-server's DOM emulation dependency (domino) when serializing fallback raw-content elements such as <iframe>, <noembed>, <noframes>, and <noscript>. The vulnerability arises because domino's serializer did not escape closing tags in dynamic text content inside these elements during server-side rendering (SSR). This allows injected closing tags to prematurely close elements and inject executable script blocks, leading to same-origin XSS attacks. Patched versions include 22.0.7, 21.2.19, and 20.3.27. Workarounds include disabling critical CSS inlining, avoiding binding user-controlled data inside these elements, or sanitizing user input.
AI Analysis
Technical Summary
The vulnerability (CVE-2026-69149) affects @angular/platform-server versions up to 19.2.25 due to improper escaping of closing tags in fallback raw-content elements during SSR by the domino library. This flaw allows an attacker to inject malicious scripts via dynamic text content bound inside elements like <iframe>, <noembed>, <noframes>, and <noscript>. When the server-side rendered HTML is parsed by browsers or re-parsed during SSR post-processing, the injected closing tags can prematurely terminate these elements and enable script execution in the user's browser context, resulting in same-origin Cross-Site Scripting (XSS). This can lead to session hijacking, credential theft, unauthorized actions, and defacement. The issue is patched in versions 22.0.7, 21.2.19, and 20.3.27 of @angular/platform-server. Mitigations include disabling critical CSS inlining to prevent domino from re-parsing HTML, avoiding user-controlled bindings inside affected elements, or sanitizing inputs to escape or remove closing tags.
Potential Impact
This vulnerability enables attackers to perform same-origin Cross-Site Scripting (XSS) attacks on users visiting SSR-rendered pages that bind user-controlled data inside fallback raw-content elements. Exploitation can result in session hijacking, theft of credentials, unauthorized actions performed on behalf of users, and website defacement. The vulnerability affects server-side rendered Angular applications using vulnerable versions of @angular/platform-server and can compromise the security of affected web applications and their users.
Mitigation Recommendations
A fix is available in @angular/platform-server versions 22.0.7, 21.2.19, and 20.3.27. Users should update to one of these patched versions to remediate the vulnerability. If immediate updating is not possible, mitigations include disabling critical CSS inlining in Angular SSR post-processing to prevent domino from re-parsing and re-serializing HTML, avoiding binding user-controlled data inside fallback raw-content elements (<iframe>, <noembed>, <noframes>, <noscript>), and sanitizing user inputs to strip or escape closing tags before rendering. These mitigations reduce the risk of exploitation until the patch can be applied.
Platform server: Angular SSR: Missing Fallback Raw-Content Serialization Escaping leads to Cross-Site Scripting (XSS) (CVE-2026-69149)
Description
A Cross-Site Scripting (XSS) vulnerability exists in @angular/platform-server's DOM emulation dependency (domino) when serializing fallback raw-content elements such as <iframe>, <noembed>, <noframes>, and <noscript>. The vulnerability arises because domino's serializer did not escape closing tags in dynamic text content inside these elements during server-side rendering (SSR). This allows injected closing tags to prematurely close elements and inject executable script blocks, leading to same-origin XSS attacks. Patched versions include 22.0.7, 21.2.19, and 20.3.27. Workarounds include disabling critical CSS inlining, avoiding binding user-controlled data inside these elements, or sanitizing user input.
CVSS v4.0
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability (CVE-2026-69149) affects @angular/platform-server versions up to 19.2.25 due to improper escaping of closing tags in fallback raw-content elements during SSR by the domino library. This flaw allows an attacker to inject malicious scripts via dynamic text content bound inside elements like <iframe>, <noembed>, <noframes>, and <noscript>. When the server-side rendered HTML is parsed by browsers or re-parsed during SSR post-processing, the injected closing tags can prematurely terminate these elements and enable script execution in the user's browser context, resulting in same-origin Cross-Site Scripting (XSS). This can lead to session hijacking, credential theft, unauthorized actions, and defacement. The issue is patched in versions 22.0.7, 21.2.19, and 20.3.27 of @angular/platform-server. Mitigations include disabling critical CSS inlining to prevent domino from re-parsing HTML, avoiding user-controlled bindings inside affected elements, or sanitizing inputs to escape or remove closing tags.
Potential Impact
This vulnerability enables attackers to perform same-origin Cross-Site Scripting (XSS) attacks on users visiting SSR-rendered pages that bind user-controlled data inside fallback raw-content elements. Exploitation can result in session hijacking, theft of credentials, unauthorized actions performed on behalf of users, and website defacement. The vulnerability affects server-side rendered Angular applications using vulnerable versions of @angular/platform-server and can compromise the security of affected web applications and their users.
Mitigation Recommendations
A fix is available in @angular/platform-server versions 22.0.7, 21.2.19, and 20.3.27. Users should update to one of these patched versions to remediate the vulnerability. If immediate updating is not possible, mitigations include disabling critical CSS inlining in Angular SSR post-processing to prevent domino from re-parsing and re-serializing HTML, avoiding binding user-controlled data inside fallback raw-content elements (<iframe>, <noembed>, <noframes>, <noscript>), and sanitizing user inputs to strip or escape closing tags before rendering. These mitigations reduce the risk of exploitation until the patch can be applied.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-vpx6-8pjr-4g3v
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-69149"]
- Ecosystems
- ["npm"]
- Database Specific Severity
- HIGH
- Cvss Version
- 4.0
Threat ID: 6a710665bf32cb7a34394b2e
Added to database: 08/03/2026, 21:21:41 UTC
Last enriched: 08/03/2026, 21:32:02 UTC
Last updated: 08/04/2026, 01:48:19 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.