Alan-Agius4

**Name of the Vulnerable Software and Affected Versions** Angular versions prior to 22.0.0-rc.2 Angular versions prior to 21.2.16 Angular versions prior to 20.3.24 Angular versions prior to 19.2.25 **Description** A Cross-Site Scripting (XSS) issue exists in the `domino` DOM emulation dependency of `@angular/platform-server` during the serialization of raw-text elements like `<script>`, `<style>`, and `<iframe>`. The problem stems from a Unicode index alignment bug in the escaping logic. Because JavaScript calculates string lengths and indices using UTF-16 code units, astral characters (such as emojis) occupy two code units. When dynamic text contains these characters before a closing tag, the index offset calculation shifts, causing `domino` to fail to escape the closing tag. An attacker can provide a payload containing an astral Unicode character and a closing tag to exit the raw-text context and execute a subsequent `<script>` block during Server-Side Rendering (SSR), leading to same-origin XSS. **Recommendations** Update to version 22.0.0-rc.2 or later. Update to version 21.2.16 or later. Update to version 20.3.24 or later. Update to version 19.2.25 or later. Avoid binding user-controlled values inside `<iframe>` or other raw-text elements. Sanitize user input placed inside raw-text elements to strip closing tags before passing it to the template.

**Name of the Vulnerable Software and Affected Versions** Angular versions prior to 22.0.1 Angular versions prior to 21.2.17 Angular versions prior to 20.3.25 **Description** Angular's `HttpTransferCache` caches HTTP requests during Server-Side Rendering (SSR) to be reused during client-side hydration, preventing redundant requests on the client. These responses are stored in `TransferState` using cache keys generated by hashing request properties, including the method, response type, mapped URL, serialized body, and sorted query parameters. The system uses a weak 32-bit DJB2-like polynomial rolling hash, which has a small hash space that allows for hash collisions. An attacker can identify a query parameter string, such as `q=aaCAZMMM`, that produces the same hash as a sensitive endpoint, such as '/api/user/profile'. If a victim visits a crafted link, the SSR process executes both requests, and the attacker-controlled response overwrites the sensitive response in the `TransferState` cache. This leads to state poisoning, where the application operates with forged data potentially bypassing security controls or causing DOM-based Cross-Site Scripting (XSS), and information leakage, where sensitive data may be disclosed. **Recommendations** Update to version 22.0.1. Update to version 21.2.17. Update to version 20.3.25. As a temporary workaround, configure `HttpClient` requests to set `transferCache` to `false` for sensitive endpoints. Alternatively, disable the HTTP transfer cache globally in the application bootstrap configuration using `withNoHttpTransferCache()` within `provideClientHydration()`.

Name of the Vulnerable Software and Affected Versions: Angular versions 18.2.14 through 18.2.21 Angular versions 19.2.15 through 19.2.16 Angular versions 20.3.0 Angular versions 21.0.0-next.3 Description: Angular uses a DI container to hold request-specific state during server-side rendering. Due to historical reasons, this container was stored as a JavaScript module-scoped global variable. Concurrent requests could inadvertently share or overwrite the global injector state, potentially leading to one request responding with data intended for another, resulting in data or token leaks. The APIs `bootstrapApplication`, `getPlatform`, and `destroyPlatform` were vulnerable. Recommendations: Angular versions 18.2.14 through 18.2.21: Update to version 18.2.21. Angular versions 19.2.15 through 19.2.16: Update to version 19.2.16. Angular versions 20.3.0: Update to version 20.3.0. Angular versions 21.0.0-next.3: No specific recommendation is available. As a workaround, disable SSR via Server Routes or builder options. As a workaround, remove any asynchronous behavior from custom `bootstrap` functions. As a workaround, remove uses of `getPlatform()` in application code. As a workaround, ensure that the server build defines `ngJitMode` as false.