GHSA-gxx4-3xcv-f8qx @angular/platform-server: Missing `<noscript>` Raw-Text Serialization Escaping leads to Cross-Site Scripting (XSS) in Angular SSR

• npm @angular/platform-server: >= 22.0.0-next.0, < 22.0.0-rc.2 → fixed in 22.0.0-rc.2 • npm @angular/platform-server: >= 21.0.0-next.0, < 21.2.16 → fixed in 21.2.16 • npm @angular/platform-server: >= 20.0.0-next.0, < 20.3.24 → fixed in 20.3.24 • npm @angular/platform-server: >= 19.0.0-next.0, < 19.2.25 → fixed in 19.2.25 • npm @angular/platform-server: <= 18.2.14 (no fix yet)

A Cross-Site Scripting (XSS) vulnerability exists in `@angular/platform-server`'s DOM emulation dependency (`domino`) when serializing the content of `` elements. When rendering dynamic text content inside a `` element via template bindings (such as `{{ value }}` or `[textContent]`), the template engine expects the browser to render the content safely. Under Server-Side Rendering (SSR), `domino` is configured with scripting enabled, meaning `` is treated as a raw-text element. However, `domino`'s serializer completely omitted `` from the list of raw-text elements requiring closing-tag escaping during DOM serialization. As a result, any occurrence of `` in the bound dynamic text was never escaped under any circumstances. The unescaped closing tag was serialized directly into the output HTML (e.g. `alert(1)`). When parsed by a browser, it closes the `` block early, allowing the injected `` block to execute in the user's browser context, causing same-origin Cross-Site Scripting (XSS). Impact This vulnerability allows an attacker to perform same-origin Cross-Site Scripting (XSS) attacks against any user visiting an SSR-rendered page that binds user-controlled data inside a `` element. This can lead to session hijacking, credentials theft, unauthorized actions on behalf of users, and defacement. Patched Versions • 22.0.0-rc.2 • 21.2.16 • 20.3.24 • 19.2.25 Workarounds If you cannot immediately update your dependencies, you can: • Avoid binding user-controlled values inside `` elements. • Sanitize any user input placed inside `` to explicitly strip closing `` tags before passing it to the template.