Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.7, a Cross-Site Scripting (XSS) vulnerability exists in @angular/platform-server's DOM emulation dependency (domino) when serializing the content of fallback raw-content elements (<iframe>, <noembed>, <noframes>, and <noscript>). This issue is fixed in versions 20.3.27, 21.2.19, and 22.0.7.

According to its self-reported version number, Angular is prior to 20.0.0, 20.x prior to 20.3.27, 21.x prior to 21.2.19 or 22.x prior to 22.0.7. It is, therefore, affected by a Cross-Site Scripting (XSS) vulnerability in the DOM emulation dependency (domino) of @angular/platform-server. Text nodes within fallback raw-content elements (<iframe>, <noembed>, <noframes> and <noscript>) are not escaped during SSR serialization, allowing an injected closing tag to break out of the element and execute a script. (CVE-2026-69149)

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Angular is a development platform for building mobile and desktop web applications using
    TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.7, a Cross-Site Scripting
    (XSS) vulnerability exists in @angular/platform-server's DOM emulation dependency (domino) when
    serializing the content of fallback raw-content elements (<iframe>, <noembed>, <noframes>, and
    <noscript>). This issue is fixed in versions 20.3.27, 21.2.19, and 22.0.7. (CVE-2026-69149)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Angular is a development platform for building mobile and desktop web applications using     TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.7, a Cross-Site Scripting     (XSS) vulnerability exists in @angular/platform-server's DOM emulation dependency (domino) when     serializing the content of fallback raw-content elements (<iframe>, <noembed>, <noframes>, and     <noscript>). This issue is fixed in versions 20.3.27, 21.2.19, and 22.0.7. (CVE-2026-69149)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
115592	Angular < 20.3.27 Cross-Site Scripting	Web App Scanning	Component Vulnerability	Version Based	high
115591	Angular 20.x < 20.3.27 Cross-Site Scripting	Web App Scanning	Component Vulnerability	Version Based	high
115590	Angular 21.x < 21.2.19 Cross-Site Scripting	Web App Scanning	Component Vulnerability	Version Based	high
115589	Angular 22.x < 22.0.7 Cross-Site Scripting	Web App Scanning	Component Vulnerability	Version Based	high
445588	SCA: security update for @angular/platform-server (GHSA-vpx6-8pjr-4g3v)	Tenable Cloud Security	SCA Checks	Local	high
445588	SCA: security update for @angular/platform-server (GHSA-vpx6-8pjr-4g3v)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
331767	Linux Distros Unpatched Vulnerability : CVE-2026-69149	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-69149

high

Tenable Plugins

high

high

high

high

high

high

high