CVE-2026-50555 angular CVE debrief

Who should care

Developers and administrators using Angular's @angular/platform-server are at risk and should prioritize patching. This vulnerability can lead to same-origin Cross-Site Scripting (XSS) attacks, allowing attackers to execute arbitrary JavaScript code on the client-side. The vulnerability has a high CVSS score of 8.6, indicating a significant risk to affected systems.

Technical summary

The vulnerability exists in the domino library used by @angular/platform-server. When serializing raw-text elements, domino supports escaping to prevent closing-tag breakout. However, a Unicode index alignment bug causes the escaping logic to fail when the bound dynamic text contains astral Unicode characters before the closing tag. This allows an attacker to supply a payload that, when serialized, leaves the closing tag raw and unescaped in the output HTML. The browser then parses the unescaped closing tag, exits the raw-text context early, and executes the subsequent <script> block, leading to same-origin Cross-Site Scripting (XSS).

Defensive priority

High priority should be given to patching affected systems. Developers should update to 22.0.0-rc.2, 21.2.16, 20.3.24, or 19.2.25 as soon as possible. In the meantime, ensure that user input is properly sanitized and validated to prevent the injection of malicious payloads.

Recommended defensive actions

• Update to 22.0.0-rc.2, 21.2.16, 20.3.24, or 19.2.25
• Implement additional input validation and sanitization for user-supplied data
• Monitor for suspicious activity and implement logging and alerting for potential XSS attacks
• Consider implementing Content Security Policy (CSP) to further mitigate XSS risks
• Review and update existing security policies and procedures to address this vulnerability

Evidence notes

The CVE record and NVD detail provide comprehensive information about the vulnerability, including its description, CVSS score, and affected versions. The source item URL provides additional information about the vulnerability, including references to mitigation and vendor references.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.