CVE-2026-69149highCWE-79

CVE-2026-69149: high-severity vulnerability in angular

Angular SSR: Missing Fallback Raw-Content Serialization Escaping leads to Cross-Site Scripting (XSS)

Published

Follow this CVE+ Monitor angular+ Monitor platform-server

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.6epss 0.4%
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.7, a Cross-Site Scripting (XSS) vulnerability exists in @angular/platform-server's DOM emulation dependency (domino) when serializing the content of fallback raw-content elements (<iframe>, <noembed>, <noframes>, and <noscript>). This issue is fixed in versions 20.3.27, 21.2.19, and 22.0.7.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Affected products
@angular · platform-serverangular · angular
Related CVEs — angular

In the same product, most dangerous first.

CVE-2026-111752HIGHAngular: Denial of Service via Unmatched Empty-Path Outlet Route Matching in Server-Side Rendering (SSR)EPSS 1.0%CVE-2026-111754MEDIUMAngular: Open Redirect via Protocol-Relative URLs in Server-Side Rendering (SSR)EPSS 1.0%CVE-2026-101896HIGHAngular: Denial of Service via Numeric URL Matrix Parameters in Server-Side Rendering (SSR)EPSS 0.9%CVE-2026-101895HIGHAngular SSR: Denial of Service (DoS) via Infinite Loop on Malformed DOCTYPEEPSS 0.9%CVE-2025-66035HIGHAngular HTTP Client Has XSRF Token Leakage via Protocol-Relative URLsEPSS 0.7%CVE-2026-111751HIGHAngular: Denial of Service via RouterLink Query Parameter Retention in Server-Side Rendering (SSR)EPSS 0.7%