CVE-2026-69149
Fixed upstream EPSS <1%CVSS 8.6
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.7, a Cross-Site Scripting (XSS) vulnerability exists in @angular/platform-server's DOM emulation dependency (domino) when serializing the content of fallback raw-content elements (<iframe>, <noembed>, <noframes>, and <noscript>). This issue is fixed in versions 20.3.27, 21.2.19, and 22.0.7.
Products: angular, @angular/ platform-server
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| npm | @angular/platform-server | 22.0.7 |
| npm | @angular/platform-server | 21.2.19 |
| npm | @angular/platform-server | 20.3.27 |
| npm | @angular/platform-server | no fix |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian:12 | angular.js | no fix |
| Debian:13 | angular.js | no fix |
| Ubuntu:22.04:LTS | angular.js | no fix |
| Ubuntu:24.04:LTS | angular.js | no fix |
| Ubuntu:26.04:LTS | angular.js | no fix |
| Ubuntu:26.10 | angular.js | no fix |
| Ubuntu:Pro:16.04:LTS | angular.js | no fix |
| Ubuntu:Pro:18.04:LTS | angular.js | no fix |
| Ubuntu:Pro:20.04:LTS | angular.js | no fix |