Summary
CVE-2026-50555 is a high-severity Cross-Site Scripting (XSS) vulnerability in Angular’s @angular/platform-server package, arising from a Unicode index alignment bug in its bundled domino DOM emulation library used during Server-Side Rendering (SSR). The flaw allows an unauthenticated attacker who controls user-supplied input bound into raw-text HTML elements to inject and execute arbitrary JavaScript in a victim’s browser. It carries a CVSS 4.0 score of 8.6 (High).
Technical details
- Root cause: Angular’s SSR engine uses the
dominolibrary to serialize HTML on the server before sending it to the browser.dominoincludes logic to escape closing tags inside raw-text elements (<script>,<style>,<iframe>) to prevent context breakout. However, a bug in the index-offset calculation failed to account for astral Unicode characters (e.g., emojis), which occupy two UTF-16 code units in JavaScript strings. When such a character appeared before a closing tag in the bound text, the index shifted, causing the escaping logic to silently skip the closing tag and leave it unescaped in the serialized HTML output. - Trigger condition: The application must bind user-controlled input to a raw-text element (
<script>,<style>, or<iframe>) during the SSR render cycle. This is an application-specific condition, not universal across all Angular SSR deployments. - Attack vector: Network-accessible; no authentication required. An attacker supplies a crafted payload — for example,
😀</iframe><script>alert(1)</script>— via any input channel that reaches the SSR-rendered template (e.g., URL parameters, form fields, or database-backed content rendered server-side). - Exploitation flow: The SSR engine serializes the payload without properly escaping the embedded closing tag. The browser receives the malformed HTML, exits the raw-text element context early, and executes the injected
<script>block in the same origin as the application. - Impact: Successful exploitation results in same-origin XSS, enabling session hijacking, credential theft, unauthorized actions on behalf of the victim, or further client-side attacks. User interaction (victim loading the affected page) is required for execution.
Affected software
@angular/platform-server≤ 18.2.14 — no upstream fix available from the Angular team for this branch (end-of-life)@angular/platform-server19.0.0-next.0 through < 19.2.25@angular/platform-server20.0.0-next.0 through < 20.3.24@angular/platform-server21.0.0-next.0 through < 21.2.16@angular/platform-server22.0.0-next.0 through < 22.0.0-rc.2
Severity
CVSS v3.1 Base Score: 8.1 (High)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Mitigation and recommended actions
- Immediate — upgrade
@angular/platform-serverto a patched version:- Angular 19.x → 19.2.25 or later
- Angular 20.x → 20.3.24 or later
- Angular 21.x → 21.2.16 or later
- Angular 22.x → 22.0.0-rc.2 or later
- Angular 18.x and earlier: No upstream patch is available from the Angular team. Organizations on these end-of-life branches should treat upgrade to a supported Angular major version as urgent.
- Code-level mitigation (if immediate patching is not possible): Audit SSR templates for any data binding that places user-controlled input into
<script>,<style>, or<iframe>elements, and sanitize that input to strip or encode closing tag sequences before binding. - Defense-in-depth: Implement a strict Content Security Policy (CSP) to limit the impact of any XSS that may execute, and review application logging for anomalous SSR request payloads containing Unicode characters combined with HTML tag sequences.
IONIX Status
The IONIX research team is tracking ongoing exploitation attempts and recommends immediate patching. Potentially affected assets are outlined in this post.