CVE-2026-69149: Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.7, a Cross-S
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.7, a Cross-Site Scripting (XSS) vulnerability exists in @angular/platform-server's DOM emulation dependency (domino) when serializing the content of fallback raw-content elements (<iframe>, <noembed>, <noframes>, and <noscript>). This issue is fixed in versions 20.3.27, 21.2.19, and 22.0.7.
Details
Original advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-69149
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2026-69149 | coverage & exploitation status | NVD · CVE.org |
Recent advisories for Angular is a
A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.
- unknownCVE-2026-69151: Angular is a development platform for building mobile and desktop web applications using TypeS…nvd · 2026-08-03
- unknownCVE-2026-68945: Angular is a development platform for building mobile and desktop web applications using TypeS…nvd · 2026-08-03
- highGHSA-7x27-g8rg-x87w: Angular's deprecated package has a Cross-Site Scripting issueghsa · 2026-06-24
- highGHSA-qxh6-94w6-9r5p: @angular/service-worker: Sensitive Header Leakage on Cross-Origin Redirects in Angular Se…ghsa · 2026-06-15
- mediumGHSA-f3m7-gqxr-g87x: Angular: Template and Attribute Namespace Sanitization Bypass (XSS)ghsa · 2026-06-15
- mediumGHSA-692r-grfm-v8x7: @angular/core: Angular Template and Dynamic Component Namespace Bypass leading to Cross-S…ghsa · 2026-06-15
More from NVD Recent CVEs
- unknownCVE-2026-69153: PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming t…2026-08-03
- highCVE-2026-69152: The brace-expansion library generates arbitrary strings containing a common prefix and suffix.…2026-08-03
- unknownCVE-2026-69151: Angular is a development platform for building mobile and desktop web applications using TypeS…2026-08-03
- unknownCVE-2026-68945: Angular is a development platform for building mobile and desktop web applications using TypeS…2026-08-03
- mediumCVE-2026-68930: Russh is a Rust SSH client & server library. Prior to 0.62.5, russh dispatches channel-scoped …2026-08-03