CVE-2026-69149: Angular SSR Cross-Site Scripting Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-vpx6-8pjr-4g3v",
  "modified" : "2026-08-03T16:14:43Z",
  "published" : "2026-08-03T16:14:43Z",
  "aliases" : [ "CVE-2026-69149" ],
  "summary" : "Angular SSR: Missing Fallback Raw-Content Serialization Escaping leads to Cross-Site Scripting (XSS)",
  "details" : "A Cross-Site Scripting (XSS) vulnerability exists in `@angular/platform-server`'s DOM emulation dependency (`domino`) when serializing the content of fallback raw-content elements (`<iframe>`, `<noembed>`, `<noframes>`, and `<noscript>`).\n\nWhen rendering dynamic text content inside fallback raw-content elements via template bindings, the template engine expects the browser to render the content safely. Under Server-Side Rendering (SSR), `domino` is configured with scripting enabled, meaning these elements are treated as raw-text elements.\n\nHowever, `domino`'s serializer previously did not escape text nodes within fallback raw-content elements (`<iframe>`, `<noembed>`, `<noframes>`, `<noscript>`) during DOM serialization. As a result, any occurrence of closing tags in the bound dynamic text was not escaped.\n\nThe unescaped closing tag could be serialized directly into the output HTML. When parsed by a browser or re-parsed during SSR post-processing without preserving raw-content parser state, an injected closing tag closes the element early, allowing an injected script block to execute in the user's browser context, causing same-origin Cross-Site Scripting (XSS).\n\n### Impact\n\nThis vulnerability allows an attacker to perform same-origin Cross-Site Scripting (XSS) attacks against any user visiting an SSR-rendered page that binds user-controlled data inside fallback raw-content elements (`<iframe>`, `<noembed>`, `<noframes>`, `<noscript>`). This can lead to session hijacking, credentials theft, unauthorized actions on behalf of users, and defacement.\n\n### Patched Versions\n\n- 22.0.7\n- 21.2.19\n- 20.3.27\n\n### Workarounds\nIf you cannot immediately update your dependencies, you can mitigate this issue using any of the following approaches:\n- **Disable critical CSS inlining**: Critical CSS inlining in Angular SSR post-processes the rendered HTML using `domino`. Disabling this step prevents `domino` from re-parsing and re-serializing the HTML during server-side rendering.\n  - In `angular.json`, set `inlineCritical` to `false` under style optimization options:\n    ```json\n    {\n      \"projects\": {\n        \"my-app\": {\n          \"architect\": {\n            \"build\": {\n              \"builder\": \"@angular/build:application\",\n              \"options\": {\n                \"optimization\": {\n                  \"styles\": {\n                    \"inlineCritical\": false\n                  }\n                }\n              }\n            }\n          }\n        }\n      }\n    }\n    ```\n  - When rendering programmatically with `CommonEngine`, set `inlineCriticalCss: false` in your render options.\n- **Avoid binding user-controlled values** inside fallback raw-content elements (`<iframe>`, `<noembed>`, `<noframes>`, `<noscript>`).\n- **Sanitize user input** placed inside these elements to explicitly strip or escape closing tags before passing it to the template.",
  "severity" : [ {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "npm",
      "name" : "@angular/platform-server"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "22.0.0-next.0"
      }, {
        "fixed" : "22.0.7"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "npm",
      "name" : "@angular/platform-server"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "21.0.0-next.0"
      }, {
        "fixed" : "21.2.19"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "npm",
      "name" : "@angular/platform-server"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "20.0.0-next.0"
      }, {
        "fixed" : "20.3.27"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "npm",
      "name" : "@angular/platform-server"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "last_affected" : "19.2.25"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/angular/angular/security/advisories/GHSA-vpx6-8pjr-4g3v"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/angular/angular/pull/69675"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/angular/angular/pull/69714"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/angular/angular/pull/69929"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/angular/angular/pull/69930"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/angular/domino/pull/32"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/angular/domino/commit/f88e5aa49cf2804d7c2df22ef1640eb4ec43dd56"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/angular/angular"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-79" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-08-03T16:14:43Z",
    "nvd_published_at" : null
  }
}