8.6

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-50555

CVE-2026-50555: Angular: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in @angular/platform-server

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-rc.2, 21.2.16, 20.3.24, and 19.2.25, a Cross-Site Scripting (XSS) vulnerability exists in @angular/platform-server's DOM emulation dependency (domino) when serializing the content of raw-text elements (such as <script>, <style>, and <iframe>). domino supports escaping raw-text elements during serialization to prevent closing-tag breakout. However, a Unicode index alignment bug existed in this escaping logic. In JavaScript, string lengths and character indices are calculated based on UTF-16 code units (where astral characters—such as emojis—occupy 2 code units / 4 bytes). If the bound dynamic text contained astral Unicode characters before the closing tag (e.g. </script>, </style>, or </iframe>), the index offset calculation in domino's replacement logic shifted. This misalignment caused domino to fail to replace or escape the closing tag, leaving it raw and unescaped in the output HTML. An attacker who controls the dynamic text can supply a payload containing both an astral Unicode character and a closing tag (e.g., 😀</iframe><script>alert(1)</script>). When serialized on the server during SSR, the browser parses the unescaped closing tag, exits the raw-text context early, and executes the subsequent <script> block, leading to same-origin Cross-Site Scripting (XSS). This vulnerability is fixed in 22.0.0-rc.2, 21.2.16, 20.3.24, and 19.2.25.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-50555

CVE-2026-50555:

8.6

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Total

Select your environment

→SSVCScheduled60 days

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
@angular/platform-server	npm	>= 22.0.0-next.0, < 22.0.0-rc.2	22.0.0-rc.2
@angular/platform-server	npm	>= 21.0.0-next.0, < 21.2.16	21.2.16
@angular/platform-server	npm	>= 20.0.0-next.0, < 20.3.24	20.3.24
@angular/platform-server	npm	>= 19.0.0-next.0, < 19.2.25	19.2.25
@angular/platform-server	npm	<= 18.2.14

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is an XSS flaw in domino, a dependency of @angular/platform-server, caused by improper handling of Unicode characters during HTML serialization. The analysis of the patch in angular/domino pull request #29 reveals the exact location of the bug.

The core issue was in the escapeMatchingClosingTag function (exported as ɵescapeMatchingClosingTag) in lib/NodeUtils.js. The original code used an approach to replace characters that failed when astral (multi-byte) Unicode characters were present in the string before the closing tag that needed to be escaped. This misalignment caused the closing tag (e.g., </iframe>) to be left unescaped in the output.

The fix, implemented in commit 3c2d125eb2d31d1a5e19e3ad7223fada0e9e0c7b, replaces the buggy manual replacement logic with String.prototype.replace(), which correctly handles Unicode and ensures the closing tag is always escaped.

The serializeOne function is the caller of escapeMatchingClosingTag and is responsible for the overall node serialization logic. It decides when to call the escaping function. Therefore, both serializeOne and ɵescapeMatchingClosingTag are critical functions that would appear in a runtime profile when this vulnerability is triggered. The vulnerability allows an attacker to inject a malicious script by providing a string with an astral character followed by a closing tag, which gets rendered on the server and executed in the victim's browser.

Vulnerable functions

ɵescapeMatchingClosingTag

lib/NodeUtils.js

This function is responsible for escaping closing tags within raw-text elements. The original implementation had a bug in its index calculation when astral Unicode characters were present, which caused it to fail to escape the closing tag. This vulnerability is fixed by using `String.prototype.replace`, which correctly handles Unicode characters.

serializeOne

lib/NodeUtils.js

This function serializes a DOM node and is responsible for calling `escapeMatchingClosingTag` for elements that can contain raw text. As the caller of the primary vulnerable function, it would appear in the stack trace during exploitation.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.