CVE-2026-69149

Analyzed Analyzed - Analysis Complete

XSS in Angular Platform-Server via DOM Emulation

Publication date: 2026-08-03

Last updated on: 2026-08-11

Assigner: GitHub, Inc.

Description

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.7, a Cross-Site Scripting (XSS) vulnerability exists in @angular/platform-server's DOM emulation dependency (domino) when serializing the content of fallback raw-content elements (<iframe>, <noembed>, <noframes>, and <noscript>). This issue is fixed in versions 20.3.27, 21.2.19, and 22.0.7.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-03

Last Modified

2026-08-11

Generated

2026-08-24

AI Q&A

2026-08-03

EPSS Evaluated

2026-08-22

NVD

CVE-2026-69149

EUVD

EUVD-2026-52350

Affected Vendors & Products

Vendor	Product	Version / Range
angular	angular	to 19.2.25 (inc)
angular	angular	From 20.0.0 (inc) to 20.3.27 (exc)
angular	angular	From 21.0.0 (inc) to 21.2.19 (exc)
angular	angular	From 22.0.0 (inc) to 22.0.7 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This is a Cross-Site Scripting (XSS) vulnerability in Angular's platform-server DOM emulation dependency (domino). It affects versions before 20.3.27, 21.2.19, and 22.0.7. The issue occurs when serializing content of fallback raw-content elements like iframe, noembed, noframes, and noscript, allowing malicious script execution.

Detection Guidance

To detect this XSS vulnerability in Angular's platform-server, check the installed version of @angular/platform-server. If it is below 20.3.27, 21.2.19, or 22.0.7, the system is vulnerable. Use commands like 'npm list @angular/platform-server' or 'ng version' to verify the version.

Impact Analysis

An attacker could exploit this to inject and execute malicious scripts in a user's browser when interacting with affected Angular applications. This may lead to data theft, session hijacking, or defacement of web pages served by the application.

Compliance Impact

This XSS vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality principles. For HIPAA, it may risk protected health information exposure. Compliance requires patching to mitigate risks of data breaches and unauthorized access.

Mitigation Strategies

Update Angular platform-server to versions 20.3.27, 21.2.19, or 22.0.7 or later to fix the XSS vulnerability in domino's DOM emulation.

Hi! I’m here to help you understand CVE-2026-69149. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70