Angular server‑side rendering can serialize user‑supplied input inside template content that resides within fallback raw‑content elements such as noscript, iframe, noembed, and noframes. Prior to the release of Angular 20.3.30, 21.2.22, and 22.1.4, the serializer stops at the DocumentFragment used by template.content, leaving unescaped closing tags in xmp, style, script, comments, or text nodes. When a browser parses this unescaped HTML, it exits the raw container and interprets subsequent markup as active DOM elements, allowing arbitrary JavaScript to execute in the client context. This leads to a classic cross‑site scripting condition that grants an attacker the ability to run malicious scripts, compromising confidentiality, integrity, and potentially the availability of the application for affected users.

The vulnerability affects Angular, the main open‑source web application framework. Systems using Angular versions earlier than 20.3.30, 21.2.22, or 22.1.4 and that employ server‑side rendering with @angular/platform-server are directly impacted. The affected product is the Angular framework and its DOM serialization libraries.

The CVSS score of 8.6 reflects a high‑severity risk due to the high impact of remote script execution. The EPSS score is not available, but the lack of a KEV listing indicates that there is no current public exploitation data. The most likely attack vector involves an attacker supplying crafted untrusted input that is rendered by the SSR process, resulting in execution on any user who loads the page. The vulnerability can be exploited by sending a malicious payload to a vulnerable application endpoint that feeds data into the template content.