An XSS vulnerability in Angular's SSR `domino` dependency fails to escape `` inside `` elements, allowing script injection when user-controlled data is bound.
Vulnerability
A Cross-Site Scripting (XSS) vulnerability exists in @angular/platform-server's DOM emulation dependency (domino) when serializing the content of ` elements during Server-Side Rendering (SSR). When dynamic text content is bound inside a element via template bindings such as {{ value }} or [textContent], the domino serializer omits from the list of raw-text elements requiring closing-tag escaping [1][2]. This causes any occurrence of in the bound dynamic text to remain unescaped, allowing an attacker to break out of the block. The vulnerability affects Angular versions prior to 19.2.25, 20.3.24, 21.2.16, and 22.0.0-rc.2` [3].
Exploitation
An attacker needs to inject user-controlled data into an Angular template that binds that data inside a ` element under SSR. The attacker can include a string such as in the bound value [2][3]. The domino serializer outputs this string unescaped into the HTML sent to the client (e.g., ). When the browser parses the HTML, it treats the injected as a closing tag, allowing the subsequent ` block to execute. No authentication or special network position beyond the ability to provide the input is required [2][3].
Impact
Successful exploitation enables same-origin XSS, allowing the attacker to execute arbitrary JavaScript in the victim's browser context. This can lead to session hijacking, credential theft, unauthorized actions on behalf of the user, and website defacement [2][3]. The attacker gains the full privileges of the authenticated user within the application.
Mitigation
Angular patched the vulnerability in versions 22.0.0-rc.2, 21.2.16, 20.3.24, and 19.2.25 by updating the domino dependency to include proper escaping of ` in raw-text serialization [1][3]. Users should upgrade to one of these fixed versions or later. If upgrading immediately is not possible, workarounds include avoiding binding user-controlled values inside elements, or sanitizing user input to explicitly strip any ` string before passing it to the template [2][3].
AI Insight generated on Jun 15, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
