CVE-2026-69149
Awaiting Analysis Awaiting Analysis - Queue

XSS in Angular Platform-Server via DOM Emulation

Publication date: 2026-08-03

Last updated on: 2026-08-03

Assigner: GitHub, Inc.

Description
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.7, a Cross-Site Scripting (XSS) vulnerability exists in @angular/platform-server's DOM emulation dependency (domino) when serializing the content of fallback raw-content elements (<iframe>, <noembed>, <noframes>, and <noscript>). This issue is fixed in versions 20.3.27, 21.2.19, and 22.0.7.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-03
Last Modified
2026-08-03
Generated
2026-08-03
AI Q&A
2026-08-03
EPSS Evaluated
N/A
NVD
CVE-2026-69149
EUVD
EUVD-2026-52350

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
angular platform-server to 20.3.27 (inc)
angular platform-server to 21.2.19 (inc)
angular platform-server to 22.0.7 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Cross-Site Scripting (XSS) vulnerability in Angular's platform-server DOM emulation dependency (domino). It affects versions before 20.3.27, 21.2.19, and 22.0.7. The issue occurs when serializing content of fallback raw-content elements like iframe, noembed, noframes, and noscript, allowing malicious script execution.

Detection Guidance

To detect this XSS vulnerability in Angular's platform-server, check the installed version of @angular/platform-server. If it is below 20.3.27, 21.2.19, or 22.0.7, the system is vulnerable. Use commands like 'npm list @angular/platform-server' or 'ng version' to verify the version.

Impact Analysis

An attacker could exploit this to inject and execute malicious scripts in a user's browser when interacting with affected Angular applications. This may lead to data theft, session hijacking, or defacement of web pages served by the application.

Compliance Impact

This XSS vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality principles. For HIPAA, it may risk protected health information exposure. Compliance requires patching to mitigate risks of data breaches and unauthorized access.

Mitigation Strategies

Update Angular platform-server to versions 20.3.27, 21.2.19, or 22.0.7 or later to fix the XSS vulnerability in domino's DOM emulation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-69149. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart