CVE-2026-69149: Angular Platform Server XSS Vulnerability

CVE-2026-69149 Overview

CVE-2026-69149 is a Cross-Site Scripting (XSS) vulnerability in Angular's @angular/platform-server package. The flaw resides in the domino DOM emulation dependency used for server-side rendering (SSR). When domino serializes the content of fallback raw-content elements (<iframe>, <noembed>, <noframes>, and <noscript>), it fails to escape text nodes. Downstream SSR post-processing may then reparse the output without preserving raw-text parsing state, allowing injected markup to execute in the browser. The issue affects Angular versions prior to 20.3.27, 21.2.19, and 22.0.7. It is tracked under [CWE-79] (Improper Neutralization of Input During Web Page Generation).

Critical Impact
Attackers can inject executable script into server-rendered Angular pages, leading to session theft, credential harvesting, and account takeover against authenticated users.

Affected Products

Angular @angular/platform-server versions prior to 20.3.27
Angular @angular/platform-server versions prior to 21.2.19
Angular @angular/platform-server versions prior to 22.0.7

Discovery Timeline

2026-08-03 - CVE-2026-69149 published to the National Vulnerability Database (NVD)
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2026-69149

Vulnerability Analysis

Angular applications using SSR render component templates on the server via @angular/platform-server, which relies on domino for DOM emulation. Domino serializes rendered nodes into HTML that is delivered to the browser. The vulnerability arises because domino did not treat text content inside fallback raw-content elements as data requiring escaping. Browsers parse text inside <iframe>, <noembed>, <noframes>, and <noscript> as raw character data when the relevant feature is enabled. However, when SSR pipelines or intermediate processors reparse the serialized output without the same raw-text state, embedded characters such as < and > become active markup. Application-controlled data placed inside these elements can therefore break out and inject a <script> tag or event handler.

Root Cause

The root cause is a serialization gap in lib/NodeUtils.js within domino. The serializer applied raw-content handling only to elements like <script> and <style> (PLAINTEXT mode) and did not include the fallback raw-content elements. Text nodes inside <iframe>, <noembed>, <noframes>, and <noscript> were emitted verbatim rather than HTML-escaped, breaking the invariant that serialized output must be safe to reparse.

Attack Vector

Exploitation requires user interaction (UI:P) but no authentication. An attacker supplies content that an Angular SSR application renders inside one of the fallback raw-content elements, for example by controlling a comment field or a template binding that Angular places into a <noscript> block. When the server-rendered HTML is delivered and later reparsed by a downstream transformer or the client hydration pipeline in a mode where raw-text semantics are lost, the injected markup executes in the victim's browser under the origin of the Angular application.

javascript

// Patch excerpt from lib/NodeUtils.js — fix: escape fallback raw-content text nodes
   PLAINTEXT: true
 };
 
+var hasRawContentFallback = {
+  // Text in these fallback raw-content elements is inert for browser parsing,
+  // but downstream SSR post-processing may reparse it without raw-text state.
+  IFRAME: true,
+  NOEMBED: true,
+  NOSCRIPT: true,
+  NOFRAMES: true
+};
+
 var emptyElements = {
   area: true,
   base: true,
// Source: https://github.com/angular/domino/commit/f88e5aa49cf2804d7c2df22ef1640eb4ec43dd56

The patch introduces a hasRawContentFallback table so the serializer HTML-escapes text nodes inside these four elements, closing the reparse escape path.

Detection Methods for CVE-2026-69149

Indicators of Compromise

Server-rendered HTML responses from Angular SSR endpoints containing unescaped < or > characters inside <noscript>, <iframe>, <noembed>, or <noframes> blocks.
Client-side script errors or unexpected <script> executions occurring after hydration of pages containing user-supplied content.
Outbound requests from browsers to unfamiliar domains initiated shortly after loading an Angular SSR page.

Detection Strategies

Inventory Node.js dependencies for @angular/platform-server and transitive domino versions; flag any Angular release below 20.3.27, 21.2.19, or 22.0.7.
Scan SSR response bodies in staging for the four fallback raw-content tags containing attacker-controllable substrings.
Add regression tests that submit payloads such as </noscript><script> into fields rendered by SSR templates and assert the serialized output is HTML-escaped.

Monitoring Recommendations

Enable Content Security Policy (CSP) reporting to capture inline-script and unexpected-source violations against Angular SSR origins.
Monitor web application firewall (WAF) logs for XSS payloads targeting Angular-rendered routes.
Alert on anomalous spikes in outbound requests from browser sessions to non-allowlisted third-party domains.

How to Mitigate CVE-2026-69149

Immediate Actions Required

Upgrade Angular to 20.3.27, 21.2.19, or 22.0.7 depending on the release train in use.
Verify the resolved version of domino includes commit f88e5aa49c after running npm install or yarn install.
Audit SSR templates for user-controlled data rendered inside <iframe>, <noembed>, <noframes>, or <noscript> elements and rotate any credentials exposed on affected pages.

Patch Information

The fix ships in Angular releases 20.3.27, 21.2.19, and 22.0.7, coordinated through GitHub Security Advisory GHSA-vpx6-8pjr-4g3v. Angular repository changes are tracked in Pull Request #69675, Pull Request #69714, Pull Request #69929, and Pull Request #69930. The underlying domino serializer fix is in Domino Pull Request #32 and commit f88e5aa49c.

Workarounds

Sanitize or HTML-escape any application data before it is rendered inside <noscript>, <iframe>, <noembed>, or <noframes> elements in SSR templates.
Deploy a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins.
Remove or refactor SSR templates that embed dynamic content inside the affected raw-content fallback elements until the upgrade lands.

bash

# Upgrade Angular platform-server to a patched release
npm install @angular/platform-server@22.0.7 --save

# Verify the resolved domino version includes the fix
npm ls domino

# Optional: enforce a strict CSP header at the edge
# Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'