{"id":"CVE-2026-69149","aliases":["GHSA-vpx6-8pjr-4g3v"],"url":"https://o3.security/vulnerability/CVE-2026-69149","summary":"Angular SSR: Missing Fallback Raw-Content Serialization Escaping leads to Cross-Site Scripting (XSS)","details":"Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.7, a Cross-Site Scripting (XSS) vulnerability exists in @angular/platform-server's DOM emulation dependency (domino) when serializing the content of fallback raw-content elements (<iframe>, <noembed>, <noframes>, and <noscript>). This issue is fixed in versions 20.3.27, 21.2.19, and 22.0.7.","published":"2026-08-03T16:14:39.636Z","modified":"2026-08-13T04:02:59.210396332Z","cvss":null,"epss":{"score":0.00206,"percentile":0.10878,"asOf":"2026-09-16"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"@angular/platform-server","fixedVersion":"22.0.7"},{"ecosystem":"npm","name":"@angular/platform-server","fixedVersion":"21.2.19"},{"ecosystem":"npm","name":"@angular/platform-server","fixedVersion":"20.3.27"},{"ecosystem":"npm","name":"@angular/platform-server","fixedVersion":null}],"fix":{"url":"https://github.com/angular/angular/pull/69675","label":"angular/angular#69675"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/69xxx/CVE-2026-69149.json"},{"type":"ADVISORY","url":"https://github.com/angular/angular/security/advisories/GHSA-vpx6-8pjr-4g3v"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69149"},{"type":"FIX","url":"https://github.com/angular/angular/pull/69675"},{"type":"FIX","url":"https://github.com/angular/angular/pull/69714"},{"type":"FIX","url":"https://github.com/angular/angular/pull/69929"},{"type":"FIX","url":"https://github.com/angular/angular/pull/69930"},{"type":"FIX","url":"https://github.com/angular/domino/commit/f88e5aa49cf2804d7c2df22ef1640eb4ec43dd56"},{"type":"FIX","url":"https://github.com/angular/domino/pull/32"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-13T04:02:59.210396332Z"}}