CVE-2026-69149 in platform-server
Summary
by MITRE • 08/03/2026
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.7, a Cross-Site Scripting (XSS) vulnerability exists in @angular/platform-server's DOM emulation dependency (domino) when serializing the content of fallback raw-content elements (<iframe>, <noembed>, <noframes>, and <noscript>). This issue is fixed in versions 20.3.27, 21.2.19, and 22.0.7.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/03/2026
The vulnerability under discussion affects Angular applications that utilize the @angular/platform-server package, specifically targeting the domino library's implementation of DOM emulation for server-side rendering operations. This XSS vulnerability manifests when processing raw-content elements including iframe, noembed, noframes, and noscript tags during content serialization. The flaw represents a critical security gap in how Angular handles fallback content within its server-side rendering pipeline, potentially allowing attackers to inject malicious scripts that execute in the context of end-user browsers.
The technical root cause lies in improper sanitization of content within domino's DOM emulation layer when serializing these specific HTML elements. These elements are classified as raw-content elements in HTML specifications, meaning they can contain arbitrary content without strict parsing rules applied by browsers. When Angular's server-side rendering processes these elements through the domino library, the serialized output fails to properly escape or sanitize potentially malicious content that might be present within the fallback content of these tags. This represents a classic cross-site scripting vulnerability where untrusted input flows directly into rendered output without adequate security controls.
The operational impact of this vulnerability extends beyond simple script injection attacks as it can enable sophisticated attack vectors including session hijacking, data exfiltration, and malicious code execution within user browsers. Attackers could craft malicious payloads within the content of these raw-content elements that would be executed when users interact with applications using server-side rendering. The vulnerability affects a wide range of Angular applications that rely on server-side rendering capabilities, particularly those that process user-generated content through iframe, noembed, noframes, or noscript elements. This creates significant risk for web applications handling dynamic content from untrusted sources.
Organizations should immediately upgrade to the patched versions 20.3.27, 21.2.19, or 22.0.7 depending on their Angular versioning scheme to mitigate this vulnerability. System administrators and development teams should conduct comprehensive security assessments of their Angular applications to identify any custom implementations that might be vulnerable through alternative code paths. Additionally, implementing proper input validation and content sanitization measures within applications can provide defense-in-depth protection against similar vulnerabilities. This issue aligns with CWE-79 (Cross-site Scripting) and maps to ATT&CK technique T1566.001 (Phishing via Social Media), as it enables attackers to deliver malicious payloads through compromised web applications. The vulnerability demonstrates the importance of proper security controls in server-side rendering environments where content from multiple sources must be processed safely, highlighting the need for robust sanitization mechanisms throughout the application lifecycle.