CVE-2026-50555

Name of the Vulnerable Software and Affected Versions Angular versions prior to 22.0.0-rc.2 Angular versions prior to 21.2.16 Angular versions prior to 20.3.24 Angular versions prior to 19.2.25

Description A Cross-Site Scripting (XSS) issue exists in the domino DOM emulation dependency of @angular/platform-server during the serialization of raw-text elements like <script>, <style>, and <iframe>. The problem stems from a Unicode index alignment bug in the escaping logic. Because JavaScript calculates string lengths and indices using UTF-16 code units, astral characters (such as emojis) occupy two code units. When dynamic text contains these characters before a closing tag, the index offset calculation shifts, causing domino to fail to escape the closing tag. An attacker can provide a payload containing an astral Unicode character and a closing tag to exit the raw-text context and execute a subsequent <script> block during Server-Side Rendering (SSR), leading to same-origin XSS.

Recommendations Update to version 22.0.0-rc.2 or later. Update to version 21.2.16 or later. Update to version 20.3.24 or later. Update to version 19.2.25 or later. Avoid binding user-controlled values inside <iframe> or other raw-text elements. Sanitize user input placed inside raw-text elements to strip closing tags before passing it to the template.