VYPR
← All advisories
Medium severity6.1NVD Advisory· Published Aug 3, 2026· Updated Aug 11, 2026

CVE-2026-69149

CVE-2026-69149

Description

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.7, a Cross-Site Scripting (XSS) vulnerability exists in @angular/platform-server's DOM emulation dependency (domino) when serializing the content of fallback raw-content elements (, , , and ). This issue is fixed in versions 20.3.27, 21.2.19, and 22.0.7.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
@angular/platform-servernpm
>= 22.0.0-next.0, < 22.0.722.0.7
@angular/platform-servernpm
>= 21.0.0-next.0, < 21.2.1921.2.19
@angular/platform-servernpm
>= 20.0.0-next.0, < 20.3.2720.3.27
@angular/platform-servernpm
<= 19.2.25—

Affected products

3
  • Angular/Angularllm-fuzzy2 versions
    before 20.3.27, 21.2.19, and 22.0.7+ 1 more
    • (no CPE)range: before 20.3.27, 21.2.19, and 22.0.7
    • cpe:2.3:a:angular:angular:*:*:*:*:*:node.js:*:*range: <=19.2.25
  • Angular/Dominollm-fuzzy
    Range: before 20.3.27, 21.2.19, and 22.0.7

Patches

Vulnerability mechanics

References

8

News mentions

0

No linked articles in our index yet.