highCVE-2026-69149Aug 3, 2026

CVE-2026-69149: @angular/platform-server SSR Fallback Raw-Content XSS

Pranav Khune
Penetration Testing Team Lead, SecureLayer7

Angular's server-side rendering layer fails to escape closing tags inside iframe, noembed, noframes, and noscript elements, letting attackers inject and execute arbitrary scripts in any visitor's…

Package@angular/platform-server
Ecosystemnpm
Affected>= 22.0.0-next.0, < 22.0.7
Fixed in22.0.7
CVE-2026-69149: @angular/platform-server SSR Fallback Raw-Content XSS

The problem

In @angular/platform-server >= 22.0.0-next.0, the domino DOM serializer does not include fallback raw-content elements (iframe, noembed, noframes, noscript) in its closing-tag escaping list.

When an Angular SSR template binds user-controlled text inside one of these elements, domino serializes that text verbatim. A closing tag such as </iframe> in the bound value is written straight into the HTML response, breaking out of the element context and allowing an adjacent script block to execute in the browser.

The attack requires only that user input reaches one of these bindings.

Proof of concept

A working proof-of-concept for CVE-2026-69149 in @angular/platform-server, with the exact payload below.

html
<noscript>{{ userValue }}</noscript>

<!-- userValue supplied by attacker: -->
</noscript><script>alert(document.domain)</script>

<!-- domino serializes this verbatim, producing: -->
<noscript></noscript><script>alert(document.domain)</script></noscript>

The root cause is a missing entry in domino's serializer allow-list. domino correctly escapes closing tags inside known raw-text elements (script, style), but the fallback raw-content set (iframe, noembed, noframes, noscript) was never added to that list. The patch in angular/domino#32 adds these four elements to the escapable set, so their closing tags are now rewritten to a safe entity form before the HTML string is emitted.

CWE-79 (Improper Neutralization of Input During Web Page Generation). The vulnerability surfaces specifically during SSR post-processing: domino runs with scripting enabled, so these elements are treated as raw-text, and the inline critical CSS step re-serializes the DOM, giving the unsanitized content a second opportunity to reach the response.

The fix

Upgrade @angular/platform-server to 22.0.7 (or 21.2.19 / 20.3.27 for older minor lines). If an immediate upgrade is not possible, set inlineCritical: false in angular.json optimization.styles options (or pass inlineCriticalCss: false to CommonEngine) to prevent domino from re-serializing the rendered HTML.

Alternatively, strip or HTML-encode closing tags from any user input before it reaches a template binding inside iframe, noembed, noframes, or noscript elements.

Reporter not attributed.

References: [1][2][3][4][5][6]

Related research