Skyzero

**Name of the Vulnerable Software and Affected Versions** Angular versions prior to 22.0.0-rc.2 Angular versions prior to 21.2.16 Angular versions prior to 20.3.24 Angular versions prior to 19.2.25 **Description** A Cross-Site Scripting (XSS) issue exists in the `domino` DOM emulation dependency of `@angular/platform-server` during the serialization of raw-text elements like `<script>`, `<style>`, and `<iframe>`. The problem stems from a Unicode index alignment bug in the escaping logic. Because JavaScript calculates string lengths and indices using UTF-16 code units, astral characters (such as emojis) occupy two code units. When dynamic text contains these characters before a closing tag, the index offset calculation shifts, causing `domino` to fail to escape the closing tag. An attacker can provide a payload containing an astral Unicode character and a closing tag to exit the raw-text context and execute a subsequent `<script>` block during Server-Side Rendering (SSR), leading to same-origin XSS. **Recommendations** Update to version 22.0.0-rc.2 or later. Update to version 21.2.16 or later. Update to version 20.3.24 or later. Update to version 19.2.25 or later. Avoid binding user-controlled values inside `<iframe>` or other raw-text elements. Sanitize user input placed inside raw-text elements to strip closing tags before passing it to the template.