GHSA-j3r3-mxqp-r2p4 Angular SSR: XSS via Unescaped Processing Instruction (<?...?>) Nodes in Fallback Raw-Content Elements

• npm @angular/platform-server: >= 22.0.0, < 22.1.4 → fixed in 22.1.4 • npm @angular/platform-server: >= 21.0.0, < 21.2.22 → fixed in 21.2.22 • npm @angular/platform-server: >= 20.0.0, < 20.3.30 → fixed in 20.3.30 • npm @angular/platform-server: <= 19.2.25 (no fix yet)

Summary An XSS vulnerability exists in `@angular/platform-server` during server-side rendering (SSR) HTML serialization of `ProcessingInstruction` DOM nodes (``, `nodeType === 7`) when nested inside fallback raw-content elements (``, ``, ``, ``). While processing instruction data escaped `>` to `&gt;`, it did not check for or escape matching closing tags of ancestor fallback elements (e.g., ``). When rendered in a browser with scripting enabled, an unescaped closing tag sequence in a processing instruction prematurely closes the fallback raw-content tag and causes subsequent sibling elements to execute as live HTML. Technical Description In HTML5 parsing, fallback raw-content elements (``, ``, ``, ``) place the browser's HTML tokenizer into `RAWTEXT` mode. In `RAWTEXT` mode, processing instruction tokens (``) are treated as literal raw text rather than bogus comments, and the parser ignores `>` or `?>`. The only token sequence that terminates the container is an end tag matching the container tag name (`` with `&gt;` (preventing bogus comment breakouts in normal HTML data states) but left `` contained ``. Impact & Reachability • Reachability: Processing instruction nodes cannot be authored directly through standard Angular template syntax (which parses `` into comment nodes in DOM position). Reaching this vulnerability requires application or library code calling `inject(DOCUMENT).createProcessingInstruction(target, data)` or `Renderer2` DOM insertion methods with untrusted user input passed to `data` inside a fallback raw-content container. • Impact: In applications that programmatically construct processing instruction nodes inside fallback elements during server-side rendering, an attacker controlling the processing instruction data can break out of the container and execute arbitrary JavaScript in victims' browsers. Proof of Concept (Minimal Reproduction) ```ts import { Component, ElementRef, Renderer2, inject, DOCUMENT, AfterViewInit } from '@angular/core'; @Component({ selector: 'app-root', standalone: true, template: `` }) export class AppComponent implements AfterViewInit { private r = inject(Renderer2); private el = inject(ElementRef); private doc = inject(DOCUMENT); ngAfterViewInit() { const host = this.el.nativeElement.querySelector('#host'); // Attacker-controlled input passed as Processing Instruction data const pi = this.doc.createProcessingInstruction('x', ' const img = this.r.createElement('img'); this.r.setAttribute(img, 'src', 'x'); this.r.setAttribute(img, 'onerror', 'alert("SSR_PI_XSS")'); this.r.appendChild(host, img); } } ``` Vulnerable SSR Output: ```html ``` Workarounds • Avoid passing untrusted user input into `document.createProcessingInstruction(target, data)` when the node is inserted into ``, ``, ``, or `` during server-side rendering. • Manually sanitize or replace `<` with `&lt;` in any untrusted data passed to processing instruction nodes on the server.