CVE-2026-69149

Name of the Vulnerable Software and Affected Versions Angular versions prior to 20.3.27 Angular versions prior to 21.2.19 Angular versions prior to 22.0.7

Description A Cross-Site Scripting (XSS) issue exists in the domino DOM emulation dependency of @angular/platform-server during the serialization of fallback raw-content elements, specifically <iframe>, <noembed>, <noframes>, and <noscript>. When rendering dynamic text via template bindings under Server-Side Rendering (SSR), the domino serializer fails to escape text nodes within these elements. This allows closing tags in bound dynamic text to be serialized directly into the output HTML. If the HTML is parsed by a browser or re-parsed during SSR post-processing, the injected closing tag can terminate the element prematurely, enabling the execution of an injected script block in the user's browser context.

Recommendations Update to version 20.3.27 or later. Update to version 21.2.19 or later. Update to version 22.0.7 or later. Disable critical CSS inlining by setting inlineCritical to false in angular.json or setting inlineCriticalCss: false when using CommonEngine. Avoid binding user-controlled values inside <iframe>, <noembed>, <noframes>, and <noscript> elements. Sanitize user input placed inside these elements to strip or escape closing tags before passing them to the template.