{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/platform-server-22/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"id":"CVE-2026-69149"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["platform-server (19)","platform-server (20)","platform-server (21)","platform-server (22)"],"_cs_severities":["high"],"_cs_tags":["xss","web-vulnerability","angular"],"_cs_type":"advisory","_cs_vendors":["Angular"],"content_html":"\u003cp\u003eA Cross-Site Scripting (XSS) vulnerability, identified as CVE-2026-69149, affects the \u003ccode\u003e@angular/platform-server\u003c/code\u003e package, specifically within its integration with the \u003ccode\u003edomino\u003c/code\u003e DOM emulation library. The issue stems from the improper serialization of fallback raw-content elements, including \u003ccode\u003e\u0026lt;iframe\u0026gt;\u003c/code\u003e, \u003ccode\u003e\u0026lt;noembed\u0026gt;\u003c/code\u003e, \u003ccode\u003e\u0026lt;noframes\u0026gt;\u003c/code\u003e, and \u003ccode\u003e\u0026lt;noscript\u0026gt;\u003c/code\u003e. When dynamic user-controlled text is bound within these elements, the serializer fails to escape closing tags. During Server-Side Rendering (SSR) post-processing, the unescaped closing tags are rendered into the final HTML output. When a browser subsequently parses this HTML, the injected closing tag causes the browser to terminate the element prematurely, allowing an attacker to inject and execute arbitrary JavaScript within the user's session context. This vulnerability impacts multiple versions of Angular, including those in the 19, 20, 21, and 22 release lines.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for same-origin XSS attacks against users visiting SSR-rendered applications. Potential impacts include session hijacking, theft of sensitive credentials, unauthorized performative actions on behalf of the user, and website defacement. Organizations using SSR with user-supplied data input in the specified elements are at high risk.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate \u003ccode\u003e@angular/platform-server\u003c/code\u003e to the patched versions: 22.0.7, 21.2.19, or 20.3.27, depending on the active release stream.\u003c/li\u003e\n\u003cli\u003eIf patching is not immediately feasible, disable \u003ccode\u003einlineCritical\u003c/code\u003e style optimization in \u003ccode\u003eangular.json\u003c/code\u003e or within \u003ccode\u003eCommonEngine\u003c/code\u003e render options to prevent the vulnerable \u003ccode\u003edomino\u003c/code\u003e re-serialization process.\u003c/li\u003e\n\u003cli\u003eImplement strict input sanitization to strip or escape closing tags from any user-controlled data intended for placement inside \u003ccode\u003e\u0026lt;iframe\u0026gt;\u003c/code\u003e, \u003ccode\u003e\u0026lt;noembed\u0026gt;\u003c/code\u003e, \u003ccode\u003e\u0026lt;noframes\u0026gt;\u003c/code\u003e, or \u003ccode\u003e\u0026lt;noscript\u0026gt;\u003c/code\u003e elements.\u003c/li\u003e\n\u003cli\u003eAudit codebase for bindings that place user-supplied content inside these specific raw-content tags.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-03T17:59:24Z","date_published":"2026-08-03T17:59:24Z","id":"https://feed.craftedsignal.io/briefs/2026-08-angular-ssr-xss/","summary":"A Cross-Site Scripting (XSS) vulnerability in @angular/platform-server (CVE-2026-69149) allows script injection via improper serialization of fallback raw-content elements during server-side rendering.","title":"Cross-Site Scripting Vulnerability in Angular Server-Side Rendering","url":"https://feed.craftedsignal.io/briefs/2026-08-angular-ssr-xss/"}],"language":"en","title":"CraftedSignal Threat Feed - Platform-Server (22)","version":"https://jsonfeed.org/version/1.1"}