| Gói / sản phẩm | Phiên bản bị ảnh hưởng | Phiên bản đã vá |
|---|---|---|
| angular | = 22.0.0≥ 19.0.0, < 19.2.25≥ 20.0.0, < 20.3.24≥ 21.0.0, < 21.2.16≤ 18.2.14 | 19.2.2520.3.2421.2.16 |
| @angular/platform-server | ≥ 19.0.0-next.0, < 19.2.25≥ 20.0.0-next.0, < 20.3.24≥ 21.0.0-next.0, < 21.2.16≥ 22.0.0-next.0, < 22.0.0-rc.2≤ 18.2.14 | 19.2.2520.3.2421.2.1622.0.0-rc.2 |
A Cross-Site Scripting (XSS) vulnerability exists in @angular/platform-server's DOM emulation dependency (domino) when serializing the content of <noscript> elements.
When rendering dynamic text content inside a <noscript> element via template bindings (such as {{ value }} or [textContent]), the template engine expects the browser to render the content safely. Under Server-Side Rendering (SSR), domino is configured with scripting enabled, meaning <noscript> is treated as a raw-text element.
However, domino's serializer completely omitted <noscript> from the list of raw-text elements requiring closing-tag escaping during DOM serialization. As a result, any occurrence of in the bound dynamic text was .
</noscript>The unescaped closing tag was serialized directly into the output HTML (e.g. <noscript></noscript><script>alert(1)</script></noscript>). When parsed by a browser, it closes the <noscript> block early, allowing the injected <script> block to execute in the user's browser context, causing same-origin Cross-Site Scripting (XSS).
This vulnerability allows an attacker to perform same-origin Cross-Site Scripting (XSS) attacks against any user visiting an SSR-rendered page that binds user-controlled data inside a <noscript> element. This can lead to session hijacking, credentials theft, unauthorized actions on behalf of users, and defacement.
If you cannot immediately update your dependencies, you can:
<noscript> elements.<noscript> to explicitly strip closing </noscript> tags before passing it to the template.Bạn đang dùng một trong các sản phẩm này? Quét site để biết có đang lộ phiên bản có lỗ hổng không.
Quét site miễn phí