GHSA-gxx4-3xcv-f8qx
NoneCVSS
—
EPSS
—
Published
Jun 15, 2026
CISA due date
—
The record
@angular/platform-server: Missing `<noscript>` Raw-Text Serialization Escaping leads to Cross-Site Scripting (XSS) in Angular SSR
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | @angular/platform-server | 0 | No fix |
| npm | @angular/platform-server | 19.0.0-next.0 | 19.2.25 |
| npm | @angular/platform-server | 20.0.0-next.0 | 20.3.24 |
| npm | @angular/platform-server | 21.0.0-next.0 | 21.2.16 |
| npm | @angular/platform-server | 22.0.0-next.0 | 22.0.0-rc.2 |
Related vulnerabilities
- CVE-2026-50556 Angular is a development platform for building mobile and desktop web applications using… Same vulnerability
- CVE-2026-50555 Angular is a development platform for building mobile and desktop web applications using… Also affects @angular/platform-server
- CVE-2026-50168 Angular is a development platform for building mobile and desktop web applications using… Also affects @angular/platform-server
- CVE-2026-46417 Angular is a development platform for building mobile and desktop web applications using… Also affects @angular/platform-server
- GHSA-hqr9-c56f-3x7f @angular/platform-server: Improper Neutralization of Input During Web Page Generation… Also affects @angular/platform-server
- GHSA-xrxm-cp7j-8xf6 @angular/platform-server: URL Parser Differential leading to SSRF Allowlist Bypass Also affects @angular/platform-server
- GHSA-rfh7-fxqc-q52v @angular/platform-server: SSRF via Hostname Hijacking Also affects @angular/platform-server
- CVE-2026-41423 Angular is a development platform for building mobile and desktop web applications using… Also affects @angular/platform-server