---
id: CVE-2026-69149
aliases:
  - GHSA-vpx6-8pjr-4g3v
title: >-
  Angular SSR: Missing Fallback Raw-Content Serialization Escaping leads to
  Cross-Site Scripting (XSS)
summary: >-
  Angular SSR: Missing Fallback Raw-Content Serialization Escaping leads to
  Cross-Site Scripting (XSS)
severity: high
cwe:
  - CWE-79
vendor: angular
product: '@angular/platform-server'
ecosystem: npm
affected:
  - '@angular/platform-server >= 22.0.0-next.0, < 22.0.7'
  - '@angular/platform-server >= 21.0.0-next.0, < 21.2.19'
  - '@angular/platform-server >= 20.0.0-next.0, < 20.3.27'
  - '@angular/platform-server <= 19.2.25'
patched:
  - '@angular/platform-server 22.0.7'
  - '@angular/platform-server 21.2.19'
  - '@angular/platform-server 20.3.27'
published: '2026-08-03'
updated: '2026-08-03'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-vpx6-8pjr-4g3v'
references:
  - url: 'https://github.com/angular/angular/security/advisories/GHSA-vpx6-8pjr-4g3v'
  - url: 'https://github.com/angular/angular/pull/69675'
  - url: 'https://github.com/angular/angular/pull/69714'
  - url: 'https://github.com/angular/angular/pull/69929'
  - url: 'https://github.com/angular/angular/pull/69930'
  - url: 'https://github.com/angular/domino/pull/32'
  - url: >-
      https://github.com/angular/domino/commit/f88e5aa49cf2804d7c2df22ef1640eb4ec43dd56
  - url: 'https://github.com/advisories/GHSA-vpx6-8pjr-4g3v'
tags:
  - ghsa
  - npm
ingestedAt: '2026-08-03T16:26:24.172Z'
epss: 0.00206
epssPercentile: 0.10964
---

## Overview

A Cross-Site Scripting (XSS) vulnerability exists in `@angular/platform-server`'s DOM emulation dependency (`domino`) when serializing the content of fallback raw-content elements (`<iframe>`, `<noembed>`, `<noframes>`, and `<noscript>`).

When rendering dynamic text content inside fallback raw-content elements via template bindings, the template engine expects the browser to render the content safely. Under Server-Side Rendering (SSR), `domino` is configured with scripting enabled, meaning these elements are treated as raw-text elements.

However, `domino`'s serializer previously did not escape text nodes within fallback raw-content elements (`<iframe>`, `<noembed>`, `<noframes>`, `<noscript>`) during DOM serialization. As a result, any occurrence of closing tags in the bound dynamic text was not escaped.

The unescaped closing tag could be serialized directly into the output HTML. When parsed by a browser or re-parsed during SSR post-processing without preserving raw-content parser state, an injected closing tag closes the element early, allowing an injected script block to execute in the user's browser context, causing same-origin Cross-Site Scripting (XSS).

### Impact

This vulnerability allows an attacker to perform same-origin Cross-Site Scripting (XSS) attacks against any user visiting an SSR-rendered page that binds user-controlled data inside fallback raw-content elements (`<iframe>`, `<noembed>`, `<noframes>`, `<noscript>`). This can lead to session hijacking, credentials theft, unauthorized actions on behalf of users, and defacement.

### Patched Versions

- 22.0.7
- 21.2.19
- 20.3.27

### Workarounds
If you cannot immediately update your dependencies, you can mitigate this issue using any of the following approaches:
- **Disable critical CSS inlining**: Critical CSS inlining in Angular SSR post-processes the rendered HTML using `domino`. Disabling this step prevents `domino` from re-parsing and re-serializing the HTML during server-side rendering.
  - In `angular.json`, set `inlineCritical` to `false` under style optimization options:
    ```json
    {
      "projects": {
        "my-app": {
          "architect": {
            "build": {
              "builder": "@angular/build:application",
              "options": {
                "optimization": {
                  "styles": {
                    "inlineCritical": false
                  }
                }
              }
            }
          }
        }
      }
    }
    ```
  - When rendering programmatically with `CommonEngine`, set `inlineCriticalCss: false` in your render options.
- **Avoid binding user-controlled values** inside fallback raw-content elements (`<iframe>`, `<noembed>`, `<noframes>`, `<noscript>`).
- **Sanitize user input** placed inside these elements to explicitly strip or escape closing tags before passing it to the template.

## Affected packages

- `@angular/platform-server >= 22.0.0-next.0, < 22.0.7`
- `@angular/platform-server >= 21.0.0-next.0, < 21.2.19`
- `@angular/platform-server >= 20.0.0-next.0, < 20.3.27`
- `@angular/platform-server <= 19.2.25`

## Remediation

Upgrade to a patched release:

- `@angular/platform-server 22.0.7`
- `@angular/platform-server 21.2.19`
- `@angular/platform-server 20.3.27`