Technical impact
The flaw resides in Angular’s server–side rendering engine, where a missing escape check for </noscript> tags inside dynamically bound content allows a malicious closing tag to terminate the <noscript> element early. The browser then interprets the following user‑supplied script as executable code, enabling attackers to run arbitrary JavaScript in the victim’s browser context. This can lead to data theft, session hijacking, or further exploitation of the application, with a CVSS score of 8.6 indicating high severity.
Affected Systems
Angular versions prior to 22.0.0‑rc.2, 21.2.16, 20.3.24, and 19.2.25 are vulnerable. The issue is present in the @angular/platform‑server component which relies on the Domino DOM emulation library. Users of these Angular releases that employ server‑side rendering with <noscript> tags containing template bindings are at risk.
Risk and Exploitability
The vulnerability is considered high risk due to the lack of an escape mechanism for </noscript> during SSR, but the EPSS score is not available, making the precise likelihood of exploitation unclear. It is not listed in the CISA KEV catalog, suggesting no publicly reported exploits yet. The attack vector is a server‑side rendered application that accepts user‑controlled content in <noscript> elements; an attacker would need to provoke template rendering with malicious data containing </noscript>. Once triggered, the same‑origin XSS payload would execute with the privileges of the page.
Github GHSA