PT-2026-49566 · Domino+1 · Domino+1
CVSS v4.0
8.6
High
| Vector | AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
Angular versions prior to 22.0.0-rc.2
Angular versions prior to 21.2.16
Angular versions prior to 20.3.24
Angular versions prior to 19.2.25
Description
A Cross-Site Scripting (XSS) issue exists in the DOM emulation dependency
domino used by @angular/platform-server during the serialization of <noscript> elements. When using Server-Side Rendering (SSR), domino treats <noscript> as a raw-text element but fails to include it in the list of elements requiring closing-tag escaping. Consequently, if dynamic text content is rendered inside a <noscript> element via template bindings like {{ value }} or [textContent], any occurrence of </noscript> is not escaped and is serialized directly into the HTML. This allows an attacker to close the <noscript> block prematurely and inject a <script> block that executes in the user's browser context, potentially leading to session hijacking, credential theft, or unauthorized actions.Recommendations
Update to version 22.0.0-rc.2.
Update to version 21.2.16.
Update to version 20.3.24.
Update to version 19.2.25.
Avoid binding user-controlled values inside
<noscript> elements.
Sanitize user input placed inside <noscript> to explicitly strip closing </noscript> tags before passing it to the template.Exploit
Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Angular
Domino