CVE-2026-69149

A Cross-Site Scripting (XSS) vulnerability exists in @angular/platform-server's DOM emulation dependency (domino) when serializing the content of fallback raw-content elements (<iframe>, <noembed>, <noframes>, and <noscript>).

When rendering dynamic text content inside fallback raw-content elements via template bindings, the template engine expects the browser to render the content safely. Under Server-Side Rendering (SSR), domino is configured with scripting enabled, meaning these elements are treated as raw-text elements.

However, domino's serializer previously did not escape text nodes within fallback raw-content elements (<iframe>, <noembed>, <noframes>, <noscript>) during DOM serialization. As a result, any occurrence of closing tags in the bound dynamic text was not escaped.

The unescaped closing tag could be serialized directly into the output HTML. When parsed by a browser or re-parsed during SSR post-processing without preserving raw-content parser state, an injected closing tag closes the element early, allowing an injected script block to execute in the user's browser context, causing same-origin Cross-Site Scripting (XSS).

Impact

This vulnerability allows an attacker to perform same-origin Cross-Site Scripting (XSS) attacks against any user visiting an SSR-rendered page that binds user-controlled data inside fallback raw-content elements (<iframe>, <noembed>, <noframes>, <noscript>). This can lead to session hijacking, credentials theft, unauthorized actions on behalf of users, and defacement.

Patched Versions

• 22.0.7
• 21.2.19
• 20.3.27

Workarounds

If you cannot immediately update your dependencies, you can mitigate this issue using any of the following approaches:

• Disable critical CSS inlining: Critical CSS inlining in Angular SSR post-processes the rendered HTML using domino. Disabling this step prevents domino from re-parsing and re-serializing the HTML during server-side rendering.
  • In angular.json, set inlineCritical to false under style optimization options:

    {
      "projects": {
        "my-app": {
          "architect": {
            "build": {
              "builder": "@angular/build:application",
              "options": {
                "optimization": {
                  "styles": {
                    "inlineCritical": false
                  }
                }
              }
            }
          }
        }
      }
    }
    

  • When rendering programmatically with CommonEngine, set inlineCriticalCss: false in your render options.
• Avoid binding user-controlled values inside fallback raw-content elements (<iframe>, <noembed>, <noframes>, <noscript>).
• Sanitize user input placed inside these elements to explicitly strip or escape closing tags before passing it to the template.

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.7, a Cross-Site Scripting (XSS) vulnerability exists in @angular/platform-server's DOM emulation dependency (domino) when serializing the content of fallback raw-content elements (<iframe>, <noembed>, <noframes>, and <noscript>). This issue is fixed in versions 20.3.27, 21.2.19, and 22.0.7.

TuxCare rebuilt 6 @angular packages to address 1 CVE. Fixed in 5.2.7-tuxcare.5.

TuxCare rebuilt 6 @angular packages to address 1 CVE. Fixed in 6.0.1-tuxcare.5.

TuxCare rebuilt 6 @angular packages to address 1 CVE. Fixed in 6.1.10-tuxcare.11.

TuxCare rebuilt 6 @angular packages to address 1 CVE. Fixed in 7.2.0-tuxcare.3.

TuxCare rebuilt 6 @angular packages to address 1 CVE. Fixed in 7.2.11-tuxcare.4.

TuxCare rebuilt 6 @angular packages to address 1 CVE. Fixed in 7.2.16-tuxcare.11.

TuxCare rebuilt 6 @angular packages to address 1 CVE. Fixed in 8.0.0-tuxcare.4.

TuxCare rebuilt 6 @angular packages to address 1 CVE. Fixed in 8.2.14-tuxcare.11.

TuxCare rebuilt 5 @angular packages to address 1 CVE. Fixed in 10.2.5-tuxcare.10.

TuxCare rebuilt 3 @angular packages to address 1 CVE. Fixed in 11.2.0-tuxcare.4.

TuxCare rebuilt 6 @angular packages to address 1 CVE. Fixed in 9.1.13-tuxcare.12.

TuxCare rebuilt 3 @angular packages to address 1 CVE. Fixed in 11.2.11-tuxcare.4.

TuxCare rebuilt 3 @angular packages to address 1 CVE. Fixed in 12.0.0-tuxcare.4.

TuxCare rebuilt 3 @angular packages to address 1 CVE. Fixed in 12.2.16-tuxcare.4.

TuxCare rebuilt 3 @angular packages to address 1 CVE. Fixed in 12.2.0-tuxcare.4.

TuxCare rebuilt 6 @angular packages to address 1 CVE. Fixed in 7.2.1-tuxcare.4.

TuxCare rebuilt 3 @angular packages to address 1 CVE. Fixed in 13.3.0-tuxcare.4.

TuxCare rebuilt 3 @angular packages to address 1 CVE. Fixed in 14.2.8-tuxcare.4.

TuxCare rebuilt 6 @angular packages to address 1 CVE. Fixed in 5.1.0-tuxcare.4.

TuxCare rebuilt 3 @angular packages to address 1 CVE. Fixed in 14.2.12-tuxcare.3.

TuxCare rebuilt 3 @angular packages to address 1 CVE. Fixed in 14.3.0-tuxcare.10.

TuxCare rebuilt 3 @angular packages to address 1 CVE. Fixed in 15.2.10-tuxcare.12.

TuxCare rebuilt 3 @angular packages to address 3 CVEs. Fixed in 16.2.11-tuxcare.2.

TuxCare rebuilt 3 @angular packages to address 3 CVEs. Fixed in 16.2.12-tuxcare.12.

TuxCare rebuilt 3 @angular packages to address 4 CVEs. Fixed in 17.1.0-tuxcare.4.

TuxCare rebuilt 3 @angular packages to address 3 CVEs. Fixed in 17.3.12-tuxcare.14.

TuxCare rebuilt 3 @angular packages to address 3 CVEs. Fixed in 19.2.23-tuxcare.3.

TuxCare rebuilt 3 @angular packages to address 1 CVE. Fixed in 15.0.3-tuxcare.4.

TuxCare rebuilt 3 @angular packages to address 3 CVEs. Fixed in 18.1.2-tuxcare.4.

TuxCare rebuilt 3 @angular packages to address 3 CVEs. Fixed in 18.2.12-tuxcare.4.

TuxCare rebuilt 3 @angular packages to address 1 CVE. Fixed in 15.2.1-tuxcare.3.

TuxCare rebuilt 3 @angular packages to address 3 CVEs. Fixed in 18.2.14-tuxcare.13.

TuxCare rebuilt 3 @angular packages to address 1 CVE. Fixed in 15.2.2-tuxcare.3.

TuxCare rebuilt 3 @angular packages to address 1 CVE. Fixed in 15.2.6-tuxcare.3.

TuxCare rebuilt 3 @angular packages to address 3 CVEs. Fixed in 19.2.21-tuxcare.5.

TuxCare rebuilt 6 @angular packages to address 1 CVE. Fixed in 5.2.11-tuxcare.13.

TuxCare rebuilt 3 @angular packages to address 1 CVE. Fixed in 13.3.11-tuxcare.3.

TuxCare rebuilt 3 @angular packages to address 3 CVEs. Fixed in 16.2.7-tuxcare.3.

TuxCare rebuilt 3 @angular packages to address 1 CVE. Fixed in 13.3.12-tuxcare.4.

TuxCare rebuilt 3 @angular packages to address 1 CVE. Fixed in 13.4.0-tuxcare.9.

TuxCare rebuilt 6 @angular packages to address 1 CVE. Fixed in 5.1.2-tuxcare.4.

TuxCare rebuilt 13 @angular packages to address 8 CVEs. Fixed in 19.2.18-tuxcare.1.

TuxCare rebuilt 13 @angular packages to address 8 CVEs. Fixed in 19.2.14-tuxcare.1.

TuxCare rebuilt 13 @angular packages to address 9 CVEs. Fixed in 18.2.13-tuxcare.1.

TuxCare rebuilt 2 @angular packages to address 3 CVEs. Fixed in 19.2.25-tuxcare.4.

TuxCare rebuilt @angular/language-service to address 9 CVEs. Fixed in 19.2.14-tuxcare.3.