CVE-2026-69149

Overview

Angular is a TypeScript-based web development platform for building scalable single-page and server-side rendered applications. It provides a modular architecture, powerful dependency injection, and built-in tools for building modern, performant, and maintainable applications across web, mobile, and desktop environments.

A Cross-Site Scripting (XSS) vulnerability (CVE-2026-69149) has been identified in @angular/platform-server's DOM emulation dependency, domino, when serializing the content of fallback raw-content elements: <iframe>, <noembed>, <noframes>, and <noscript>.

Per OWASP, Cross-Site Scripting is a class of vulnerability in which an attacker injects malicious script into content that is later rendered in another user's browser, allowing the attacker to execute arbitrary JavaScript in the context of the victim's session.

This issue affects multiple versions of Angular.

‍

Details

Module Info

• Product: Angular
• Affected packages: @angular/platform-server
• Affected versions:
  • <=19.2.25
  • >=20.0.0-next.0 <20.3.27
  • >=21.0.0-next.0 <21.2.19
  • >=22.0.0-next.0 <22.0.7
• GitHub repository: https://github.com/angular/angular
• Published packages: https://www.npmjs.com/package/@angular/platform-server
• Package manager: npm
• Fixed in:
  • Angular NES
  • Angular 20.3.27, 21.2.19 and 22.0.7 (OSS)

Vulnerability Info

Under SSR, domino is configured with scripting enabled, which causes it to treat <iframe>, <noembed>, <noframes>, and <noscript> as raw-text elements — the same way a browser would. When a template binds dynamic, potentially user-controlled text inside one of these fallback raw-content elements, Angular expects the renderer to preserve that raw-text handling on output.

However, domino's HTML serializer did not escape text nodes located inside these fallback raw-content elements during DOM serialization. As a result, any closing tag present in the bound dynamic text (for example, </iframe> or </noscript>) was written directly into the output HTML instead of being escaped.

When that output is parsed by a browser, or re-parsed during SSR post-processing (such as critical CSS inlining) without preserving raw-content parser state, the unescaped closing tag prematurely terminates the element. Markup that follows — including an attacker-supplied <script> block — is then parsed as live content and executes in the victim's browser, within the same origin as the SSR-rendered application. This constitutes a same-origin Cross-Site Scripting (XSS) vulnerability.

Exploitation requires an application to render user-controlled data inside one of the four affected fallback raw-content elements via Angular template bindings, and to serve that output through @angular/platform-server-based SSR. GitHub's security advisory rates the flaw High severity under CVSS v4 (8.6), reflecting that no privileges are required and only passive user interaction is needed. GitLab's advisory scores it 8.1 High under CVSS 3.1.

When successfully exploited, this vulnerability can lead to:

• Session hijacking: theft of session cookies, localStorage data, or authentication tokens.
• Credential theft: capturing sensitive data entered by the victim.
• Unauthorized actions: performing actions on behalf of the victim within the application.
• Defacement: modifying the rendered page content shown to the victim.

‍

Mitigation

Angular has patched this issue in versions 20.3.27, 21.2.19, and 22.0.7. Applications on Angular 19.2.25 or earlier will not receive an official patch, as those versions are End-of-Life.

Users of the affected components should apply one of the following mitigations:

• Upgrade to Angular 20.3.27, 21.2.19, 22.0.7, or later.
• Disable critical CSS inlining (inlineCritical: false) in SSR builds, which prevents the vulnerable re-serialization step from running.
• Avoid binding user-controlled values inside <iframe>, <noembed>, <noframes>, and <noscript> elements, or sanitize the input to strip closing tags before binding.
• Leverage a commercial support partner like HeroDevs for post-EOL security support via Angular NES.