CVE-2026-50556

Overview

Angular is a TypeScript-based web development platform for building scalable single-page and server-side rendered applications. It provides a modular architecture, powerful dependency injection, and built-in tools for building modern, performant, and maintainable applications across web, mobile, and desktop environments.

A Cross-Site Scripting (XSS) vulnerability (CVE-2026-50556) has been identified in Angular's Platform Server, which allows attackers to bypass the escaping of <noscript> elements during Server-Side Rendering (SSR) and can lead to arbitrary JavaScript execution within the context of the victim's browser session.

Per OWASP, this vulnerability falls under Stored Cross-Site Scripting. Stored XSS occurs when an application stores untrusted input and later renders it without proper neutralization. In this case, the injected payload may execute when a user interacts with the affected element or automatically when an animation is triggered.

This issue affects multiple versions of Angular.

‍

Details

Module Info

• Product: Angular
• Affected packages: @angular/platform-server
• Affected versions:
  • <=18.2.14
  • >=19.0.0-next.0 <19.2.25
  • >=20.0.0-next.0 <20.3.24
  • >=21.0.0-next.0 <21.2.16
  • >=22.0.0-next.0 <22.0.0-rc.2
• GitHub repository: https://github.com/angular/angular
• Published packages: https://www.npmjs.com/package/@angular/platform-server
• Package manager: npm
• Fixed in:
  • OSS Angular v19.2.25, v20.3.24, v21.2.16 and v22.0.0-rc.2

Vulnerability Info

This High-severity vulnerability is found in the @angular/platform-server package in multiple published versions of Angular. The underlying defect is in domino, the DOM emulation dependency that Platform Server uses to serialize rendered HTML on the server.

When an application renders dynamic text inside a <noscript> element through a template binding such as {{ value }} or [textContent], the template engine relies on the browser to render that content safely. Under SSR, domino runs with scripting enabled, which means it treats <noscript> as a raw-text element whose closing tag must be escaped during serialization. However, domino's serializer omits <noscript> from its list of raw-text elements that require closing-tag escaping, so any </noscript> sequence in the bound dynamic text is never escaped.

An attacker who controls the dynamic text bound inside a <noscript> element can therefore supply a value containing a closing tag, for example </noscript><script>alert(1)</script>. The unescaped closing tag is serialized directly into the output HTML, so when a browser parses the server-rendered page it closes the <noscript> block early and executes the injected script that follows, producing same-origin Cross-Site Scripting.

This vulnerability allows an attacker to perform same-origin Cross-Site Scripting against any user who visits an SSR-rendered page that binds user-controlled data inside a <noscript> element. Successful exploitation results in arbitrary JavaScript execution within the victim's browser session, which can lead to:

• Session hijacking: Stealing session cookies, localStorage data, or authentication tokens.
• Credential theft: Capturing user credentials entered into the compromised page.
• Unauthorized actions: Performing state-changing actions (like clicking buttons or submitting forms) on behalf of the authenticated user.
• Defacement: Altering the content rendered to the user.

‍

Mitigation

Angular versions prior to 19 were already End-of-Life when this CVE was published and will not receive any updates to address this issue. For more information see here.

Users of the affected components should apply one of the following mitigations:

• Migrate affected applications to a patched version of Angular.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.