In HTML5, these elements place the browser in RAWTEXT mode, where internal content is parsed as literal text until a matching closing tag is encountered. Because Angular's serializer treats the contents of a <template> as a separate DocumentFragment with a null parent, the traversal logic fails to detect the outer fallback raw-content container. Consequently, malicious input containing closing tags is rendered unescaped in the SSR output, leading to a container breakout and subsequent execution of injected markup when the page is parsed by a victim's browser. This bypasses Angular's built-in protections for standard text interpolation.

Impact

Successful exploitation allows for the execution of arbitrary JavaScript within the context of the user's session, potentially leading to session hijacking, data exfiltration, or unauthorized actions on behalf of the user. The vulnerability is reachable through both standard text interpolation and imperative DOM construction via Renderer2. Affected versions include @angular/platform-server v19.2.25 and below, 20.0.0 through 20.3.29, 21.0.0 through 21.2.21, and 22.0.0 through 22.1.3. Organizations utilizing Angular SSR with dynamic, user-controllable input rendered within the specified template containers are at risk.

Recommendation

Prioritized remediation involves updating the @angular/platform-server package to the latest patched releases. If immediate patching is not feasible, restrict the use of untrusted user input within <template> elements nested in <noscript>, <iframe>, <noembed>, or <noframes>. Security teams should audit codebases for components that use Renderer2 to dynamically construct DOM structures involving these fallback elements to ensure input is sanitized before rendering.