AIKIDO-2026-289293

@angular/platform-server is vulnerable to Cross-Site Scripting (XSS)

Cross-Site Scripting (XSS)GHSA-vpx6-8pjr-4g3v Published 4 days ago

High Risk

This Affects:

@angular/platform-server

0.0.1 - 20.3.26

Fixed in 20.3.27

21.0.0 - 21.2.18

Fixed in 21.2.19

22.0.0 - 22.0.6

Fixed in 22.0.7

Are you affected? Scan for Free

TL;DR

@angular/platform-server contains a cross-site scripting (XSS) vulnerability in its server-side rendering (SSR) pipeline due to improper serialization of fallback raw-content elements (<iframe>, <noembed>, <noframes>, and <noscript>). When user-controlled data is bound inside these elements, specially crafted input can inject closing tags and arbitrary HTML or JavaScript into the rendered output, leading to same-origin XSS in users' browsers.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and you are using Angular Server-Side Rendering (SSR) and bind untrusted or user-controlled content inside fallback raw-content elements.

Background info

@angular/platform-server is vulnerable to Cross-Site Scripting (XSS) in versions 0.0.1 - 20.3.26, 21.0.0 - 21.2.18 and 22.0.0 - 22.0.6.

How to fix this

Upgrade the @angular/platform-server library to the patch version. If this is not possible, disable critical CSS inlining (inlineCritical), avoid binding user-controlled data inside fallback raw-content elements.

High Risk