Read the docs
TI-2026-37278 Aliases CVE-2026-50556GHSA-gxx4-3xcv-f8qx

Angular: Missing `<noscript>` Raw-Text Serialization Escaping leads to Cross-Site Scripting (XSS) in Angular SSR

Priority LOW 39CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Cross-site scripting
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-rc.2, 21.2.16, 20.3.24, and 19.2.25, a Cross-Site Scripting (XSS) vulnerability exists in @angular/platform-server's DOM emulation dependency (domino) when serializing the content of <noscript> elements. When rendering dynamic text content inside a <noscript> element via template bindings (such as {{ value }} or [textContent]), the template engine expects the browser to render the content safely. Under Server-Side Rendering (SSR), domino is configured with scripting enabled, meaning <noscript> is treated as a raw-text element. However, domino's serializer completely omitted <noscript> from the list of raw-text elements requiring closing-tag escaping during DOM serialization. As a result, any occurrence of </noscript> in the bound dynamic text was never escaped under any circumstances. The unescaped closing tag was serialized directly into the output HTML (e.g. <noscript></noscript><script>alert(1)</script></noscript>). When parsed by a browser, it closes the <noscript> block early, allowing the injected <script> block to execute in the user's browser context, causing same-origin Cross-Site Scripting (XSS). This vulnerability is fixed in 22.0.0-rc.2, 21.2.16, 20.3.24, and 19.2.25.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00412 35th percentileScored 2026-11-07
Fix Fixed angular (angular): 22.0.0-rc.2, 21.2.16, 20.3.24 +1@angular/platform-server (npm): 22.0.0-rc.2, 21.2.16, 20.3.24 +1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
angularangular22.0.0-next.0 to before 22.0.0-rc.2; 21.0.0-next.0 to before 21.2.16; 20.0.0-next.0 to before 20.3.24; 19.0.0-next.0 to before 19.2.25; up to 18.2.1422.0.0-rc.2, 21.2.16, 20.3.24, 19.2.25Patch availableCNA
—@angular/platform-server (npm)22.0.0-next.0 to before 22.0.0-rc.222.0.0-rc.2Patch availableGHSA-gxx4-3xcv-f8qx
—@angular/platform-server (npm)21.0.0-next.0 to before 21.2.1621.2.16Patch availableGHSA-gxx4-3xcv-f8qx
—@angular/platform-server (npm)20.0.0-next.0 to before 20.3.2420.3.24Patch availableGHSA-gxx4-3xcv-f8qx
—@angular/platform-server (npm)19.0.0-next.0 to before 19.2.2519.2.25Patch availableGHSA-gxx4-3xcv-f8qx
—@angular/platform-server (npm)up to 18.2.14—No fix listedGHSA-gxx4-3xcv-f8qx
  • angular Vendorangular Affected 22.0.0-next.0 to before 22.0.0-rc.2; 21.0.0-next.0 to before 21.2.16; 20.0.0-next.0 to before 20.3.24; 19.0.0-next.0 to before 19.2.25; up to 18.2.14 Fixed in 22.0.0-rc.2, 21.2.16, 20.3.24, 19.2.25 Patch available CNA
  • @angular/platform-server (npm) Vendor— Affected 22.0.0-next.0 to before 22.0.0-rc.2 Fixed in 22.0.0-rc.2 Patch available GHSA-gxx4-3xcv-f8qx
  • @angular/platform-server (npm) Vendor— Affected 21.0.0-next.0 to before 21.2.16 Fixed in 21.2.16 Patch available GHSA-gxx4-3xcv-f8qx
  • @angular/platform-server (npm) Vendor— Affected 20.0.0-next.0 to before 20.3.24 Fixed in 20.3.24 Patch available GHSA-gxx4-3xcv-f8qx
  • @angular/platform-server (npm) Vendor— Affected 19.0.0-next.0 to before 19.2.25 Fixed in 19.2.25 Patch available GHSA-gxx4-3xcv-f8qx
  • @angular/platform-server (npm) Vendor— Affected up to 18.2.14 Fixed in — No fix listed GHSA-gxx4-3xcv-f8qx

CPE configurations NVD · 16

CPEVersionsRoleVendor
cpe:2.3:a:angular:angular:*:*:*:*:*:node.js:*:*up to 18.2.14; 19.0.0 to before 19.2.25; 20.0.0 to before 20.3.24; 21.0.0 to before 21.2.16Vulnerableangular
cpe:2.3:a:angular:angular:22.0.0:next0:*:*:*:node.js:*:*22.0.0 next0Vulnerableangular
cpe:2.3:a:angular:angular:22.0.0:next1:*:*:*:node.js:*:*22.0.0 next1Vulnerableangular
cpe:2.3:a:angular:angular:22.0.0:next10:*:*:*:node.js:*:*22.0.0 next10Vulnerableangular
cpe:2.3:a:angular:angular:22.0.0:next11:*:*:*:node.js:*:*22.0.0 next11Vulnerableangular
cpe:2.3:a:angular:angular:22.0.0:next12:*:*:*:node.js:*:*22.0.0 next12Vulnerableangular
cpe:2.3:a:angular:angular:22.0.0:next2:*:*:*:node.js:*:*22.0.0 next2Vulnerableangular
cpe:2.3:a:angular:angular:22.0.0:next3:*:*:*:node.js:*:*22.0.0 next3Vulnerableangular
cpe:2.3:a:angular:angular:22.0.0:next4:*:*:*:node.js:*:*22.0.0 next4Vulnerableangular
cpe:2.3:a:angular:angular:22.0.0:next5:*:*:*:node.js:*:*22.0.0 next5Vulnerableangular
  • cpe:2.3:a:angular:angular:*:*:*:*:*:node.js:*:* Versions up to 18.2.14; 19.0.0 to before 19.2.25; 20.0.0 to before 20.3.24; 21.0.0 to before 21.2.16 Vulnerable ·angular
  • cpe:2.3:a:angular:angular:22.0.0:next0:*:*:*:node.js:*:* Versions 22.0.0 next0 Vulnerable ·angular
  • cpe:2.3:a:angular:angular:22.0.0:next1:*:*:*:node.js:*:* Versions 22.0.0 next1 Vulnerable ·angular
  • cpe:2.3:a:angular:angular:22.0.0:next10:*:*:*:node.js:*:* Versions 22.0.0 next10 Vulnerable ·angular
  • cpe:2.3:a:angular:angular:22.0.0:next11:*:*:*:node.js:*:* Versions 22.0.0 next11 Vulnerable ·angular
  • cpe:2.3:a:angular:angular:22.0.0:next12:*:*:*:node.js:*:* Versions 22.0.0 next12 Vulnerable ·angular
  • cpe:2.3:a:angular:angular:22.0.0:next2:*:*:*:node.js:*:* Versions 22.0.0 next2 Vulnerable ·angular
  • cpe:2.3:a:angular:angular:22.0.0:next3:*:*:*:node.js:*:* Versions 22.0.0 next3 Vulnerable ·angular
  • cpe:2.3:a:angular:angular:22.0.0:next4:*:*:*:node.js:*:* Versions 22.0.0 next4 Vulnerable ·angular
  • cpe:2.3:a:angular:angular:22.0.0:next5:*:*:*:node.js:*:* Versions 22.0.0 next5 Vulnerable ·angular
Show 6 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:angular:angular:22.0.0:next6:*:*:*:node.js:*:*22.0.0 next6Vulnerableangular
cpe:2.3:a:angular:angular:22.0.0:next7:*:*:*:node.js:*:*22.0.0 next7Vulnerableangular
cpe:2.3:a:angular:angular:22.0.0:next8:*:*:*:node.js:*:*22.0.0 next8Vulnerableangular
cpe:2.3:a:angular:angular:22.0.0:next9:*:*:*:node.js:*:*22.0.0 next9Vulnerableangular
cpe:2.3:a:angular:angular:22.0.0:rc0:*:*:*:node.js:*:*22.0.0 rc0Vulnerableangular
cpe:2.3:a:angular:angular:22.0.0:rc1:*:*:*:node.js:*:*22.0.0 rc1Vulnerableangular
  • cpe:2.3:a:angular:angular:22.0.0:next6:*:*:*:node.js:*:* Versions 22.0.0 next6 Vulnerable ·angular
  • cpe:2.3:a:angular:angular:22.0.0:next7:*:*:*:node.js:*:* Versions 22.0.0 next7 Vulnerable ·angular
  • cpe:2.3:a:angular:angular:22.0.0:next8:*:*:*:node.js:*:* Versions 22.0.0 next8 Vulnerable ·angular
  • cpe:2.3:a:angular:angular:22.0.0:next9:*:*:*:node.js:*:* Versions 22.0.0 next9 Vulnerable ·angular
  • cpe:2.3:a:angular:angular:22.0.0:rc0:*:*:*:node.js:*:* Versions 22.0.0 rc0 Vulnerable ·angular
  • cpe:2.3:a:angular:angular:22.0.0:rc1:*:*:*:node.js:*:* Versions 22.0.0 rc1 Vulnerable ·angular

Remediation

  • Fix · CNA angular (angular) Fixed in 22.0.0-rc.2, 21.2.16, 20.3.24, 19.2.25
  • Fix · GHSA-gxx4-3xcv-f8qx @angular/platform-server (npm) Fixed in 22.0.0-rc.2 Advisory →
  • Fix · GHSA-gxx4-3xcv-f8qx @angular/platform-server (npm) Fixed in 21.2.16 Advisory →
  • Fix · GHSA-gxx4-3xcv-f8qx @angular/platform-server (npm) Fixed in 20.3.24 Advisory →
  • Fix · GHSA-gxx4-3xcv-f8qx @angular/platform-server (npm) Fixed in 19.2.25 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

Not affected: 2 products
  • Red Hat Enterprise Linux 8
  • Red Hat Fuse 7

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-50556
  2. 2026-10-03 Alias added: GHSA-gxx4-3xcv-f8qx

References

Patch 1

Advisory 4

Other 2

  • TI-2026-60076 Angular: SSRF and Cross-Origin Credential Disclosure via URL Resolution Discrepancy in SSR CVSS 4.0HIGH 8.6
  • TI-2026-60080 Angular: SSR XSS via Unescaped <template> Content Across DocumentFragment Boundaries in Fallback Raw-Content Elements CVSS 4.0HIGH 8.6
  • TI-2026-60078 Angular: SSR XSS via Unescaped Processing Instruction (<?...?>) Nodes in Fallback Raw-Content Elements CVSS 4.0HIGH 8.6
  • TI-2025-37971 A reflected cross-site scripting (XSS) vulnerability in CKeditor v46.1.0 & Angular… CVSS 3.1MEDIUM 5.4
  • TI-2026-36931 Angular: URL Parser Differential in @angular/platform-server leading to SSRF Allowlist Bypass CVSS 4.0HIGH 8.8
  • TI-2026-34131 Angular: SSRF via Hostname Hijacking in @angular/platform-server CVSS 4.0HIGH 8.8
See all 28 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences