CVE-2026-50556: Angular SSR XSS Vulnerability in noscript Element Serialization

Technical summary

The vulnerability exists in @angular/platform-server's SSR rendering pipeline, specifically in how it delegates DOM serialization to the domino library. When Angular templates bind dynamic values using expressions like {{ value }} or [textContent] inside <noscript> elements, the SSR renderer must escape special characters to prevent HTML injection. However, domino's serializer failed to treat <noscript> as a raw-text element requiring escape-sequence protection for closing tags. Specifically, any occurrence of the literal string </noscript> within bound text content was passed through unescaped into the serialized HTML output. When a browser parses the resulting HTML, the unescaped </noscript> closes the noscript block prematurely, and any following <script> tags are no longer protected by the noscript semantics, resulting in script execution in the page's origin context. This is a DOM serialization bypass vulnerability (CWE-79).

Business impact

For organizations deploying Angular applications with SSR enabled, this vulnerability could allow attackers to steal session tokens, redirect users to phishing sites, deface page content, or exfiltrate sensitive data rendered within noscript fallback content. The attack requires user interaction (the user must view the malicious payload in a browser), but no special privileges are needed to craft the payload. If your application uses SSR to render any user-controlled or third-party data within noscript elements, the risk is material. The medium CVSS score reflects the requirement for user interaction; however, the impact scope is cross-site, making this a significant defect in your SSR security posture.

Affected systems

Angular applications using @angular/platform-server for Server-Side Rendering are affected if running versions prior to 19.2.25 (LTS), 20.3.24, 21.2.16, or 22.0.0-rc.2. This includes applications that render dynamic content into <noscript> blocks as part of their SSR output. Non-SSR Angular applications are not affected, as the vulnerability is specific to domino's role in server-side DOM emulation. Verify your Angular version and whether SSR is enabled in your build and deployment pipeline.

Exploitability

The vulnerability is relatively straightforward to exploit for an attacker with the ability to control text content bound to a <noscript> element—for example, through user input, query parameters, or third-party content. No sophisticated techniques are required; a simple payload like </noscript><script>alert(document.cookie)</script> will close the noscript block and execute. The attack requires the victim to view the rendered page in a browser, which is a realistic user-interaction requirement. There is no report of public exploitation or in-the-wild attacks as of the publication date, and the vulnerability has not been added to the CISA KEV catalog.

Remediation

Upgrade Angular to version 19.2.25 or later, 20.3.24 or later, 21.2.16 or later, or 22.0.0-rc.2 or later. These versions include a fix to domino's serializer to properly escape closing tags in raw-text elements, including <noscript>. After upgrading, regenerate and redeploy your SSR bundle. If immediate patching is not feasible, audit your templates to identify and remove dynamic content bindings inside <noscript> elements, or use other methods to serve fallback content that do not rely on SSR template binding.

Patch guidance

Identify which version of Angular you are currently running (check package.json or package-lock.json). Consult the Angular release notes to confirm the exact minimum patch version for your major release line. Run npm update @angular/platform-server to pull in the patched version, then thoroughly test your SSR pipeline in a staging environment—particularly any pages that render noscript content. Verify that your build system correctly bundles the updated domino dependency. After deployment to production, monitor for any regressions in noscript rendering behavior.

Detection guidance

Search your application codebase for <noscript> elements that contain Angular template bindings ({{ }}, *ngIf, [textContent], etc.). These are the high-risk patterns. Monitor application logs and web server access logs for suspicious payloads containing </noscript> in request parameters or body content. Implement Content-Security-Policy headers (script-src) to restrict script execution and mitigate the impact of any successful injection. Conduct penetration testing on your SSR endpoints to identify whether noscript content can be controlled by an attacker.

Why prioritize this

This vulnerability merits timely attention because it affects a core security boundary in Angular SSR applications. The combination of a known attack vector (template binding), a critical defect in serialization logic, and the broad use of Angular in production systems creates measurable risk. Although the CVSS score is medium and KEV status is false, the technical nature of the flaw (complete absence of escaping for a known attack pattern) suggests it should be patched promptly. Organizations running Angular SSR in production should treat this as a priority fix within your standard patch cycle.

Risk score, explained

The CVSS 3.1 score of 6.1 (MEDIUM) reflects an Attack Vector of Network, Attack Complexity of Low, and no authentication or special privileges required. However, User Interaction is required (the victim must view the page), and the impact is limited to Confidentiality and Integrity with no Availability impact (Scope is Changed). The score does not fully capture the severity of the defect itself—a complete absence of output encoding in a known risky element—but it reasonably reflects the real-world attack cost (requires user click/visit) and blast radius (affects the page origin, not the entire system).

Frequently asked questions