Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-rc.2, 21.2.16, 20.3.24, and 19.2.25, a Cross-Site Scripting (XSS) vulnerability exists in @angular/platform-server's DOM emulation dependency (domino) when serializing the content of raw-text elements (such as <script>, <style>, and <iframe>). domino supports escaping raw-text elements during serialization to prevent closing-tag breakout. However, a Unicode index alignment bug existed in this escaping logic. In JavaScript, string lengths and character indices are calculated based on UTF-16 code units (where astral characters—such as emojis—occupy 2 code units / 4 bytes). If the bound dynamic text contained astral Unicode characters before the closing tag (e.g. </script>, </style>, or </iframe>), the index offset calculation in domino's replacement logic shifted. This misalignment caused domino to fail to replace or escape the closing tag, leaving it raw and unescaped in the output HTML. An attacker who controls the dynamic text can supply a payload containing both an astral Unicode character and a closing tag (e.g., 😀</iframe><script>alert(1)</script>). When serialized on the server during SSR, the browser parses the unescaped closing tag, exits the raw-text context early, and executes the subsequent <script> block, leading to same-origin Cross-Site Scripting (XSS). This vulnerability is fixed in 22.0.0-rc.2, 21.2.16, 20.3.24, and 19.2.25.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Angular is a development platform for building mobile and desktop web applications using     TypeScript/JavaScript and other languages. Prior to 22.0.0-rc.2, 21.2.16, 20.3.24, and 19.2.25, a Cross-     Site Scripting (XSS) vulnerability exists in @angular/platform-server's DOM emulation dependency (domino)     when serializing the content of raw-text elements (such as <script>, <style>, and <iframe>). domino     supports escaping raw-text elements during serialization to prevent closing-tag breakout. However, a     Unicode index alignment bug existed in this escaping logic. In JavaScript, string lengths and character     indices are calculated based on UTF-16 code units (where astral characterssuch as emojisoccupy 2 code     units / 4 bytes). If the bound dynamic text contained astral Unicode characters before the closing tag     (e.g. </script>, </style>, or </iframe>), the index offset calculation in domino's replacement logic     shifted. This misalignment caused domino to fail to replace or escape the closing tag, leaving it raw and     unescaped in the output HTML. An attacker who controls the dynamic text can supply a payload containing     both an astral Unicode character and a closing tag (e.g., </iframe><script>alert(1)</script>). When     serialized on the server during SSR, the browser parses the unescaped closing tag, exits the raw-text     context early, and executes the subsequent <script> block, leading to same-origin Cross-Site Scripting     (XSS). This vulnerability is fixed in 22.0.0-rc.2, 21.2.16, 20.3.24, and 19.2.25. (CVE-2026-50555)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Angular is a development platform for building mobile and desktop web applications using
    TypeScript/JavaScript and other languages. Prior to 22.0.0-rc.2, 21.2.16, 20.3.24, and 19.2.25, a Cross-
    Site Scripting (XSS) vulnerability exists in @angular/platform-server's DOM emulation dependency (domino)
    when serializing the content of raw-text elements (such as <script>, <style>, and <iframe>). domino
    supports escaping raw-text elements during serialization to prevent closing-tag breakout. However, a
    Unicode index alignment bug existed in this escaping logic. In JavaScript, string lengths and character
    indices are calculated based on UTF-16 code units (where astral characters—such as emojis—occupy 2 code
    units / 4 bytes). If the bound dynamic text contained astral Unicode characters before the closing tag
    (e.g. </script>, </style>, or </iframe>), the index offset calculation in domino's replacement logic
    shifted. This misalignment caused domino to fail to replace or escape the closing tag, leaving it raw and
    unescaped in the output HTML. An attacker who controls the dynamic text can supply a payload containing
    both an astral Unicode character and a closing tag (e.g., 😀</iframe><script>alert(1)</script>). When
    serialized on the server during SSR, the browser parses the unescaped closing tag, exits the raw-text
    context early, and executes the subsequent <script> block, leading to same-origin Cross-Site Scripting
    (XSS). This vulnerability is fixed in 22.0.0-rc.2, 21.2.16, 20.3.24, and 19.2.25. (CVE-2026-50555)

ID	Name	Product	Family	Type	Severity
322251	Linux Distros Unpatched Vulnerability : CVE-2026-50555	Nessus	Misc.	Local	high
443200	SCA: security update for @angular/platform-server (GHSA-hqr9-c56f-3x7f)	Tenable Cloud Security	SCA Checks	Local	high
443200	SCA: security update for @angular/platform-server (GHSA-hqr9-c56f-3x7f)	Tenable Self-Hosted Container Security	SCA Checks	Local	high

Detections

Analytics

CVE-2026-50555

high

Tenable Plugins

high

high

high