---
id: CVE-2026-50555
aliases:
  - GHSA-hqr9-c56f-3x7f
title: >-
  @angular/platform-server: Improper Neutralization of Input During Web Page
  Generation ('Cross-site Scripting')
summary: >-
  @angular/platform-server: Improper Neutralization of Input During Web Page
  Generation ('Cross-site Scripting')
severity: high
cwe:
  - CWE-79
vendor: angular
product: '@angular/platform-server'
ecosystem: npm
affected:
  - '@angular/platform-server >= 22.0.0-next.0, < 22.0.0-rc.2'
  - '@angular/platform-server >= 21.0.0-next.0, < 21.2.16'
  - '@angular/platform-server >= 20.0.0-next.0, < 20.3.24'
  - '@angular/platform-server >= 19.0.0-next.0, < 19.2.25'
  - '@angular/platform-server <= 18.2.14'
patched:
  - '@angular/platform-server 22.0.0-rc.2'
  - '@angular/platform-server 21.2.16'
  - '@angular/platform-server 20.3.24'
  - '@angular/platform-server 19.2.25'
published: '2026-06-15'
updated: '2026-06-15'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-hqr9-c56f-3x7f'
references:
  - url: 'https://github.com/angular/angular/security/advisories/GHSA-hqr9-c56f-3x7f'
  - url: 'https://github.com/angular/domino/pull/29'
  - url: 'https://github.com/advisories/GHSA-hqr9-c56f-3x7f'
tags:
  - ghsa
  - npm
epss: 0.00267
epssPercentile: 0.16694
ingestedAt: '2026-07-07T15:41:58.930Z'
---

## Overview

A Cross-Site Scripting (XSS) vulnerability exists in `@angular/platform-server`'s DOM emulation dependency (`domino`) when serializing the content of raw-text elements (such as `<script>`, `<style>`, and `<iframe>`).

`domino` supports escaping raw-text elements during serialization to prevent closing-tag breakout. However, a **Unicode index alignment bug** existed in this escaping logic.

In JavaScript, string lengths and character indices are calculated based on UTF-16 code units (where astral characters—such as emojis—occupy 2 code units / 4 bytes). If the bound dynamic text contained astral Unicode characters _before_ the closing tag (e.g. `</script>`, `</style>`, or `</iframe>`), the index offset calculation in `domino`'s replacement logic shifted.

This misalignment caused `domino` to fail to replace or escape the closing tag, leaving it raw and unescaped in the output HTML.

An attacker who controls the dynamic text can supply a payload containing both an astral Unicode character and a closing tag (e.g., `😀</iframe><script>alert(1)</script>`). When serialized on the server during SSR, the browser parses the unescaped closing tag, exits the raw-text context early, and executes the subsequent `<script>` block, leading to same-origin Cross-Site Scripting (XSS).

### Impact

This vulnerability allows an attacker to perform same-origin Cross-Site Scripting (XSS) attacks against any user visiting an SSR-rendered page that binds user-controlled data inside raw-text elements. This can lead to session hijacking, credentials theft, unauthorized actions on behalf of users, and defacement.

### Patched Versions

- 22.0.0-rc.2
- 21.2.16
- 20.3.24
- 19.2.25

### Workarounds

If you cannot immediately update your dependencies, you can:

- Avoid binding user-controlled values inside `<iframe>` or other raw-text elements.
- Sanitize any user input placed inside raw-text elements to explicitly strip closing tags before passing it to the template.

## Affected packages

- `@angular/platform-server >= 22.0.0-next.0, < 22.0.0-rc.2`
- `@angular/platform-server >= 21.0.0-next.0, < 21.2.16`
- `@angular/platform-server >= 20.0.0-next.0, < 20.3.24`
- `@angular/platform-server >= 19.0.0-next.0, < 19.2.25`
- `@angular/platform-server <= 18.2.14`

## Remediation

Upgrade to a patched release:

- `@angular/platform-server 22.0.0-rc.2`
- `@angular/platform-server 21.2.16`
- `@angular/platform-server 20.3.24`
- `@angular/platform-server 19.2.25`