Summary

Technical Description

1. Per DOM specifications, the children of a <template> element reside in a separate DocumentFragment (template.content), whose own parentNode is null.
2. The serializer's ancestor traversal previously only inspected element nodes. When traversing upward from a node inside template.content, traversal terminated immediately at the DocumentFragment boundary.
3. Because traversal stopped before reaching the outer document tree, enclosing fallback raw-content ancestors (such as <noscript> or <iframe>) were not discovered. As a result, closing sequences like </noscript> within <template> content were emitted unescaped.

Impact & Reachability

• Framework Guarantee Bypass: Angular guarantees that standard text interpolation ({{ userInput }} bound as element text content) is safe by default without manual sanitization. This vulnerability bypasses that guarantee during SSR HTML serialization when untrusted input is interpolated inside template content within fallback containers.
• Template Authoring: Writing literal <xmp> or <style> directly inside a component's <template> markup requires relaxed template schema checks (CUSTOM ELEMENTS SCHEMA or NO ERRORS SCHEMA). However, standard HTML comments and text nodes inside <template> within <noscript> are reachable without relaxed schemas.
• Imperative DOM Construction: Components or directives that construct DOM structures imperatively via Renderer2 bypass template compiler schema checks entirely and are unconditionally affected.

Proof of Concept (Minimal Reproduction)

import { Component } from '@angular/core';

@Component({
 selector: 'app-root',
 standalone: true,
 template: `
  <noscript>
   <template>
    <xmp>{{ payload }}</xmp>
   </template>
  </noscript>
 `
})
export class AppComponent {
 // Attacker-controlled input bound via standard text interpolation
 payload = '</noscript><img src=x onerror=alert("SSR TEMPLATE XSS")>';
}

<noscript><template><xmp></noscript><img src=x onerror=alert("SSR TEMPLATE XSS")></xmp></template></noscript>

Workarounds

• Avoid rendering untrusted user input inside <template> elements nested within <noscript>, <iframe>, <noembed>, or <noframes> in server-rendered templates.
• Avoid programmatic DOM assembly of <template> elements inside fallback containers when handling untrusted data.