EUVD-2026-75703
GHSA-v3p8-whq6-r5jg
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-delivered XSS requiring victim page load (UI:R); scope change to browser context (S:C); no privileges needed from attacker side.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
5DescriptionCVE.org
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.30, 21.2.22, and 22.1.4, Angular server-side rendering (SSR) in @angular/platform-server serializes untrusted input inside template content nested in fallback raw-content elements such as noscript, iframe, noembed, and noframes. The Domino serializer's fallbackRawContentTags traversal stopped at the DocumentFragment used by template.content, so matching closing tags in xmp, style, script, comments, or text nodes were not escaped. Standard interpolation with comments or text nodes is reachable without relaxed schemas; literal xmp or style requires CUSTOM_ELEMENTS_SCHEMA or NO_ERRORS_SCHEMA, while Renderer2 imperative DOM construction is unconditionally affected. When HTML5 RAWTEXT browser parsing encounters the unescaped closing tag, it exits the fallback container and interprets trailing markup as active DOM elements, enabling arbitrary JavaScript execution. This issue is fixed in versions 20.3.30, 21.2.22, and 22.1.4.
AnalysisAI
Cross-site scripting via Angular's server-side rendering package (@angular/platform-server) allows arbitrary JavaScript execution in end-user browsers when untrusted input is serialized inside template content nested within fallback raw-content elements (noscript, iframe, noembed, noframes) on versions prior to 20.3.30, 21.2.22, and 22.1.4. The root cause is a traversal bug in Angular's Domino serializer: the ancestor-tag walk that determines whether closing tags must be escaped stopped at DocumentFragment boundaries (the type returned by template.content), so unescaped closing tags could break out of their container and activate attacker-controlled markup when the browser's HTML5 RAWTEXT parser processes the server-rendered HTML. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation is limited to applications using @angular/platform-server (Angular SSR); client-side-only Angular apps are entirely unaffected. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 8.6 (AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N) correctly reflects a network-reachable, low-complexity XSS with high browser-session impact, but real-world exploitability is conditioned on both deployment mode and Angular template structure. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to the patched release for your version line: v20.3.30 (https://github.com/angular/angular/releases/tag/v20.3.30), v21.2.22 (https://github.com/angular/angular/releases/tag/v21.2.22), or v22.1.4 (https://github.com/angular/angular/releases/tag/v22.1.4). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit your software inventory to identify all applications and services using @angular/platform-server versions prior to 20.3.30 (branch 20.x), 21.2.22 (branch 21.x), or 22.1.4 (branch 22.x). …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
We need to produce a JSON with all the specified fields. I'll synthesize the data. First, the product name: "Angular" i
Cross-site scripting in Angular's Template Compiler allows attackers to inject arbitrary JavaScript through unsanitized
Command injection via untrusted Markdown rendering in the Angular Language Service VS Code extension (versions prior to
Arbitrary code execution in the Angular Language Service VS Code extension prior to 21.2.4 allows attackers to silently
Server-Side Request Forgery in Angular's @angular/platform-server (SSR) lets remote unauthenticated attackers hijack the
Cross-site scripting in Angular's server-side rendering engine (`@angular/platform-server`) allows arbitrary JavaScript
Server-Side Rendering in Angular's @angular/platform-server leaks server-side credentials to attacker-controlled origins
Cross-site scripting in Angular's internationalization (i18n) pipeline allows attacker-controlled JavaScript to execute
Cross-site scripting in Angular's compiler and runtime (@angular/core, @angular/compiler) prior to versions 20.3.28, 21.
HttpTransferCache in Angular's SSR stack leaks authenticated user data to subsequent unauthenticated visitors when hiera
The Angular SSR is a server-rise rendering tool for Angular applications. Versions prior to 21.2.0-rc.1, 21.1.5, 20.3.17
The Angular SSR is a server-rise rendering tool for Angular applications. An Open Redirect vulnerability exists in the i
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today