Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-rc.2, 21.2.16, 20.3.24, and 19.2.25, a Cross-Site Scripting (XSS) vulnerability exists in @angular/platform-server's DOM emulation dependency (domino) when serializing the content of raw-text elements (such as <script>, <style>, and <iframe>). domino supports escaping raw-text elements during serialization to prevent closing-tag breakout. However, a Unicode index alignment bug existed in this escaping logic. In JavaScript, string lengths and character indices are calculated based on UTF-16 code units (where astral characters—such as emojis—occupy 2 code units / 4 bytes). If the bound dynamic text contained astral Unicode characters before the closing tag (e.g. </script>, </style>, or </iframe>), the index offset calculation in domino's replacement logic shifted. This misalignment caused domino to fail to replace or escape the closing tag, leaving it raw and unescaped in the output HTML. An attacker who controls the dynamic text can supply a payload containing both an astral Unicode character and a closing tag (e.g., 😀</iframe><script>alert(1)</script>). When serialized on the server during SSR, the browser parses the unescaped closing tag, exits the raw-text context early, and executes the subsequent <script> block, leading to same-origin Cross-Site Scripting (XSS). This vulnerability is fixed in 22.0.0-rc.2, 21.2.16, 20.3.24, and 19.2.25.

According to its self-reported version number, Angular is prior to 19.0.0, 19.x prior to 19.2.25, 20.x prior to 20.3.24 or 21.x prior to 21.2.16. It is, therefore, affected by multiple vulnerabilities:

- A Cross-Site Scripting (XSS) vulnerability in the DOM emulation dependency (domino) of @angular/platform-server. A Unicode index alignment bug in the raw-text element escaping logic allows a payload containing an astral character followed by a closing tag (such as </script>) to remain unescaped in the SSR output. (CVE-2026-50555)

- A Cross-Site Scripting (XSS) vulnerability in the DOM emulation dependency (domino) of @angular/platform-server. The content of <noscript> elements is not escaped during SSR serialization, allowing an injected </noscript> closing tag to break out of the element and execute a script. (CVE-2026-50556)

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Angular is a development platform for building mobile and desktop web applications using     TypeScript/JavaScript and other languages. Prior to 22.0.0-rc.2, 21.2.16, 20.3.24, and 19.2.25, a Cross-     Site Scripting (XSS) vulnerability exists in @angular/platform-server's DOM emulation dependency (domino)     when serializing the content of raw-text elements (such as <script>, <style>, and <iframe>). domino     supports escaping raw-text elements during serialization to prevent closing-tag breakout. However, a     Unicode index alignment bug existed in this escaping logic. In JavaScript, string lengths and character     indices are calculated based on UTF-16 code units (where astral characterssuch as emojisoccupy 2 code     units / 4 bytes). If the bound dynamic text contained astral Unicode characters before the closing tag     (e.g. </script>, </style>, or </iframe>), the index offset calculation in domino's replacement logic     shifted. This misalignment caused domino to fail to replace or escape the closing tag, leaving it raw and     unescaped in the output HTML. An attacker who controls the dynamic text can supply a payload containing     both an astral Unicode character and a closing tag (e.g., </iframe><script>alert(1)</script>). When     serialized on the server during SSR, the browser parses the unescaped closing tag, exits the raw-text     context early, and executes the subsequent <script> block, leading to same-origin Cross-Site Scripting     (XSS). This vulnerability is fixed in 22.0.0-rc.2, 21.2.16, 20.3.24, and 19.2.25. (CVE-2026-50555)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Angular is a development platform for building mobile and desktop web applications using
    TypeScript/JavaScript and other languages. Prior to 22.0.0-rc.2, 21.2.16, 20.3.24, and 19.2.25, a Cross-
    Site Scripting (XSS) vulnerability exists in @angular/platform-server's DOM emulation dependency (domino)
    when serializing the content of raw-text elements (such as <script>, <style>, and <iframe>). domino
    supports escaping raw-text elements during serialization to prevent closing-tag breakout. However, a
    Unicode index alignment bug existed in this escaping logic. In JavaScript, string lengths and character
    indices are calculated based on UTF-16 code units (where astral characters—such as emojis—occupy 2 code
    units / 4 bytes). If the bound dynamic text contained astral Unicode characters before the closing tag
    (e.g. </script>, </style>, or </iframe>), the index offset calculation in domino's replacement logic
    shifted. This misalignment caused domino to fail to replace or escape the closing tag, leaving it raw and
    unescaped in the output HTML. An attacker who controls the dynamic text can supply a payload containing
    both an astral Unicode character and a closing tag (e.g., 😀</iframe><script>alert(1)</script>). When
    serialized on the server during SSR, the browser parses the unescaped closing tag, exits the raw-text
    context early, and executes the subsequent <script> block, leading to same-origin Cross-Site Scripting
    (XSS). This vulnerability is fixed in 22.0.0-rc.2, 21.2.16, 20.3.24, and 19.2.25. (CVE-2026-50555)

ID	Name	Product	Family	Type	Severity
115604	Angular < 19.2.25 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	high
115603	Angular 19.x < 19.2.25 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	high
115602	Angular 20.x < 20.3.24 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	high
115601	Angular 21.x < 21.2.16 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	high
322251	Linux Distros Unpatched Vulnerability : CVE-2026-50555	Nessus	Misc.	Local	high
443200	SCA: security update for @angular/platform-server (GHSA-hqr9-c56f-3x7f)	Tenable Cloud Security	SCA Checks	Local	high
443200	SCA: security update for @angular/platform-server (GHSA-hqr9-c56f-3x7f)	Tenable Self-Hosted Container Security	SCA Checks	Local	high

Detections

Analytics

CVE-2026-50555

high

Tenable Plugins

high

high

high

high

high

high

high