Cross-Site Scripting Vulnerability in Angular's Platform Server by Google
CVE-2026-50556
8.6HIGH
What is CVE-2026-50556?
A Cross-Site Scripting (XSS) vulnerability exists in Angular's platform server caused by improper handling of elements during server-side rendering. The issue arises when dynamic text inside tags is serialized by the domino dependency. Due to incorrect escaping of these elements, it's possible for attackers to inject malicious scripts, leading to execution in the user's browser context. This vulnerability has been addressed in the latest releases of the affected Angular platform server versions.
Affected Version(s)
angular >= 22.0.0-next.0, < 22.0.0-rc.2 < 22.0.0-next.0, 22.0.0-rc.2
angular >= 21.0.0-next.0, < 21.2.16 < 21.0.0-next.0, 21.2.16
angular >= 20.0.0-next.0, < 20.3.24 < 20.0.0-next.0, 20.3.24