A web‑application framework contains a flaw that permits an attacker to inject and execute arbitrary script code when an SSR (Server‑Side Rendering) response is generated. The flaw stems from a missing escape of raw‑content elements—such as <iframe>, <noembed>, <noframes>, and <noscript>—in the DOM emulation library used by the server‑side rendering engine. When these elements are serialized, the content is emitted without the necessary escaping, allowing a crafted input to insert malicious scripts. The result is a typical browser‑side XSS that can steal session tokens, deface content, or perform other malicious actions on behalf of an authenticated user.

Both the Angular framework and the platform‑server runtime bundled with it are vulnerable. The affected releases are prior to 20.3.27, 21.2.19, and 22.0.7 respectively. Users and organizations deploying Angular versions older than those thresholds should verify their component versions.

The vulnerability carries a CVSS score of 8.6, indicating a high severity attack surface. No EPSS score is published, and the flaw is not listed in CISA’s KEV catalog. The attack vector is likely client‑side: an attacker can insert malicious markup that is rendered during SSR and delivered to the browser, where it executes in the victim’s context. Once the SSR output reaches the client, the missing escaping becomes exploitable, and the attacker can bypass typical content‑security policies if the application trusts the SSR template.