EUVD-2026-75681Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-delivered XSS with scope change to victim browser; no attacker privileges required; passive victim interaction required; full session compromise possible via JS execution.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
5DescriptionCVE.org
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.30, 21.2.22, and 22.1.4, Angular server-side rendering (SSR) in @angular/platform-server serializes ProcessingInstruction DOM nodes inside fallback raw-content elements without escaping matching ancestor closing tags. ProcessingInstruction data escaped greater-than characters but left less-than characters untouched and did not inspect fallback ancestors, so data such as a matching closing tag prematurely terminates noscript, iframe, noembed, or noframes containers. The vulnerable nodes cannot be authored through standard Angular templates; reachability requires application or library code using inject(DOCUMENT).createProcessingInstruction with attacker-controlled data or Renderer2 DOM insertion inside a fallback container. In HTML5 RAWTEXT parsing, the premature close causes subsequent sibling elements to be interpreted as live HTML and enables arbitrary JavaScript execution in a victim's browser. This issue is fixed in versions 20.3.30, 21.2.22, and 22.1.4.
AnalysisAI
Cross-site scripting in Angular's server-side rendering engine (@angular/platform-server) allows arbitrary JavaScript execution in a victim's browser when attacker-controlled data reaches a ProcessingInstruction DOM node serialized inside an HTML5 RAWTEXT fallback container. Affected Angular versions prior to 20.3.30, 21.2.22, and 22.1.4 use a domino library build that escapes > in ProcessingInstruction data but not <, permitting a crafted closing tag such as </noscript> to prematurely terminate the RAWTEXT container and cause sibling elements to render as live HTML. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires three concurrent conditions: (1) the Angular application must use server-side rendering via `@angular/platform-server` running a vulnerable version (before 20.3.30, 21.2.22, or 22.1.4); (2) application or library code must explicitly call `inject(DOCUMENT).createProcessingInstruction(target, data)` with attacker-controlled `data`, OR use `Renderer2` to insert DOM nodes inside one of the four HTML5 RAWTEXT fallback containers - `noscript`, `iframe`, `noembed`, or `noframes`; and (3) a victim user must load the SSR-rendered page in a browser. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 8.6 (AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N) accurately captures the network-accessible, high-impact nature of the flaw when triggered, but it does not reflect the significant reachability gate: standard Angular template syntax - interpolation, structural directives, component bindings - never produces `ProcessingInstruction` nodes and is entirely unaffected. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Angular 20.3.30, 21.2.22, or 22.1.4, which bundle the patched `domino` build (commit `04f987dc08ff3736b427f50941adf1722458528f`). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit your Angular applications to identify which are using server-side rendering via @angular/platform-server and their current major version. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
We need to produce a JSON with all the specified fields. I'll synthesize the data. First, the product name: "Angular" i
Cross-site scripting in Angular's Template Compiler allows attackers to inject arbitrary JavaScript through unsanitized
Command injection via untrusted Markdown rendering in the Angular Language Service VS Code extension (versions prior to
Arbitrary code execution in the Angular Language Service VS Code extension prior to 21.2.4 allows attackers to silently
Server-Side Request Forgery in Angular's @angular/platform-server (SSR) lets remote unauthenticated attackers hijack the
Cross-site scripting via Angular's server-side rendering package (@angular/platform-server) allows arbitrary JavaScript
Server-Side Rendering in Angular's @angular/platform-server leaks server-side credentials to attacker-controlled origins
Cross-site scripting in Angular's internationalization (i18n) pipeline allows attacker-controlled JavaScript to execute
Cross-site scripting in Angular's compiler and runtime (@angular/core, @angular/compiler) prior to versions 20.3.28, 21.
HttpTransferCache in Angular's SSR stack leaks authenticated user data to subsequent unauthenticated visitors when hiera
The Angular SSR is a server-rise rendering tool for Angular applications. Versions prior to 21.2.0-rc.1, 21.1.5, 20.3.17
The Angular SSR is a server-rise rendering tool for Angular applications. An Open Redirect vulnerability exists in the i
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today