A Unicode index alignment bug in the DOM‑emulation library domino, a dependency of @angular/platform-server, causes the serialization of raw‑text elements such as <script>, <style>, and <iframe> to fail when the dynamic content contains astral Unicode characters preceding the closing tag. The bug prevents the proper escape of the closing tag, allowing an attacker‑controlled payload (e.g., an emoji followed by </iframe><script>alert(1)</script>) to be rendered as raw HTML during server‑side rendering. This results in same‑origin XSS, giving the attacker the ability to execute arbitrary JavaScript in the victim’s context, read cookies, local session storage, or perform other actions allowed to the legitimate page owner.

Angular versions prior to 22.0.0‑rc.2, 21.2.16, 20.3.24, and 19.2.25 are affected. The flaw resides in the @angular/platform-server package’s use of the domino library for HTML serialization. Systems that use server‑side rendering with these Angular versions and allow user‑controlled dynamic text are vulnerable.

The CVSS score of 8.6 indicates high severity. No EPSS score is available, and the vulnerability is not currently listed in the CISA KEV catalog. Exploitation requires control over content that is serialized on the server during SSR; the attacker can supply a payload containing an astral Unicode character and a closing tag to trigger XSS. Because the attack is client‑side but originates from server‑generated content, the exposure is to any user that views the rendered page. Attackers could leverage this flaw to steal session data or perform actions within the same origin. The absence of an EPSS score and KEV status does not reduce the risk given the high CVSS and the breadth of the affected Angular releases.