{ "affected": [ { "ranges": [ { "database_specific": { "cpe": [ "cpe:2.3:a:angular:angular:*:*:*:*:*:node.js:*:*", "cpe:2.3:a:angular:angular:22.0.0:next0:*:*:*:node.js:*:*", "cpe:2.3:a:angular:angular:22.0.0:next1:*:*:*:node.js:*:*", "cpe:2.3:a:angular:angular:22.0.0:next10:*:*:*:node.js:*:*", "cpe:2.3:a:angular:angular:22.0.0:next11:*:*:*:node.js:*:*", "cpe:2.3:a:angular:angular:22.0.0:next12:*:*:*:node.js:*:*", "cpe:2.3:a:angular:angular:22.0.0:next2:*:*:*:node.js:*:*", "cpe:2.3:a:angular:angular:22.0.0:next3:*:*:*:node.js:*:*", "cpe:2.3:a:angular:angular:22.0.0:next4:*:*:*:node.js:*:*", "cpe:2.3:a:angular:angular:22.0.0:next5:*:*:*:node.js:*:*", "cpe:2.3:a:angular:angular:22.0.0:next6:*:*:*:node.js:*:*", "cpe:2.3:a:angular:angular:22.0.0:next7:*:*:*:node.js:*:*", "cpe:2.3:a:angular:angular:22.0.0:next8:*:*:*:node.js:*:*", "cpe:2.3:a:angular:angular:22.0.0:next9:*:*:*:node.js:*:*" ], "extracted_events": [ { "introduced": "0" }, { "last_affected": "18.2.14" }, { "introduced": "19.0.0" }, { "fixed": "19.2.25" }, { "introduced": "20.0.0" }, { "fixed": "20.3.24" }, { "introduced": "21.0.0" }, { "fixed": "21.2.16" }, { "introduced": "22.0.0-next0" }, { "last_affected": "22.0.0-next0" }, { "introduced": "22.0.0-next1" }, { "last_affected": "22.0.0-next1" }, { "introduced": "22.0.0-next10" }, { "last_affected": "22.0.0-next10" }, { "introduced": "22.0.0-next11" }, { "last_affected": "22.0.0-next11" }, { "introduced": "22.0.0-next12" }, { "last_affected": "22.0.0-next12" }, { "introduced": "22.0.0-next2" }, { "last_affected": "22.0.0-next2" }, { "introduced": "22.0.0-next3" }, { "last_affected": "22.0.0-next3" }, { "introduced": "22.0.0-next4" }, { "last_affected": "22.0.0-next4" }, { "introduced": "22.0.0-next5" }, { "last_affected": "22.0.0-next5" }, { "introduced": "22.0.0-next6" }, { "last_affected": "22.0.0-next6" }, { "introduced": "22.0.0-next7" }, { "last_affected": "22.0.0-next7" }, { "introduced": "22.0.0-next8" }, { "last_affected": "22.0.0-next8" }, { "introduced": "22.0.0-next9" }, { "last_affected": "22.0.0-next9" } ], "source": [ "CPE_RANGE", "CPE_STRING" ] }, "events": [ { "introduced": "0" }, { "introduced": "e7566c3c475560616f97de2ab3c8f8d6f83be015" }, { "fixed": "6d1753b46b7389c10aa17da2327043fbf5296035" }, { "introduced": "40e2b5b4d13792ed7c46a1d22afcf6c12ac9c679" }, { "fixed": "c56f1ec3c349d76b1a99bd292feef10b7b8c9b4f" }, { "introduced": "00dcbf2eeb3fd18ed39148e4bc9e49a5b35cae0c" }, { "fixed": "03188ddc9ff09066f91e249230ab530a2bf8ee14" }, { "introduced": "62676269d207db80576052d080b756e938be97ea" } ], "repo": "https://github.com/angular/angular", "type": "GIT" } ], "versions": [ "22.0.0-next0", "22.0.0-next1", "22.0.0-next10", "22.0.0-next11", "22.0.0-next12", "22.0.0-next2", "22.0.0-next3", "22.0.0-next4", "22.0.0-next5", "22.0.0-next6", "22.0.0-next7", "22.0.0-next8", "22.0.0-next9" ] } ], "aliases": [ "GHSA-gxx4-3xcv-f8qx" ], "database_specific": { "cna_assigner": "GitHub_M", "cwe_ids": [ "CWE-79" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/50xxx/CVE-2026-50556.json" }, "details": "Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-rc.2, 21.2.16, 20.3.24, and 19.2.25, a Cross-Site Scripting (XSS) vulnerability exists in @angular/platform-server's DOM emulation dependency (domino) when serializing the content of \u003cnoscript\u003e elements. When rendering dynamic text content inside a \u003cnoscript\u003e element via template bindings (such as {{ value }} or [textContent]), the template engine expects the browser to render the content safely. Under Server-Side Rendering (SSR), domino is configured with scripting enabled, meaning \u003cnoscript\u003e is treated as a raw-text element. However, domino's serializer completely omitted \u003cnoscript\u003e from the list of raw-text elements requiring closing-tag escaping during DOM serialization. As a result, any occurrence of \u003c/noscript\u003e in the bound dynamic text was never escaped under any circumstances. The unescaped closing tag was serialized directly into the output HTML (e.g. \u003cnoscript\u003e\u003c/noscript\u003e\u003cscript\u003ealert(1)\u003c/script\u003e\u003c/noscript\u003e). When parsed by a browser, it closes the \u003cnoscript\u003e block early, allowing the injected \u003cscript\u003e block to execute in the user's browser context, causing same-origin Cross-Site Scripting (XSS). This vulnerability is fixed in 22.0.0-rc.2, 21.2.16, 20.3.24, and 19.2.25.", "id": "CVE-2026-50556", "modified": "2026-07-11T03:54:23.449041330Z", "published": "2026-06-22T15:38:28.166Z", "references": [ { "type": "WEB", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-50556.json" }, { "type": "ADVISORY", "url": "https://access.redhat.com/security/cve/CVE-2026-50556" }, { "type": "ADVISORY", "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/50xxx/CVE-2026-50556.json" }, { "type": "ADVISORY", "url": "https://github.com/angular/angular/security/advisories/GHSA-gxx4-3xcv-f8qx" }, { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-50556" }, { "type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2491459" }, { "type": "REPORT", "url": "https://github.com/angular/angular/issues/68903" }, { "type": "FIX", "url": "https://github.com/angular/domino/pull/29" } ], "schema_version": "1.7.5", "severity": [ { "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", "type": "CVSS_V4" } ], "summary": "Angular: Missing `\u003cnoscript\u003e` Raw-Text Serialization Escaping leads to Cross-Site Scripting (XSS) in Angular SSR" }