Cross-Site Scripting Vulnerability in Angular's Platform Server Product
CVE-2026-69149
8.6HIGH
What is CVE-2026-69149?
A Cross-Site Scripting (XSS) vulnerability has been identified in Angular's platform server due to improper DOM emulation within the 'domino' dependency. This issue arises when the application serializes the content of fallback elements, such as , , , and . Developers using affected versions prior to updates 20.3.27, 21.2.19, and 22.0.7 may be at risk of exploitation, allowing attackers to inject malicious scripts and execute unauthorized actions within the user's context.
Affected Version(s)
angular < 20.3.27 < 20.3.27
angular >= 21.0.0-next.0, < 21.2.19 < 21.0.0-next.0, 21.2.19
angular >= 22.0.0-next.0, < 22.0.7 < 22.0.0-next.0, 22.0.7