Description
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.7, a Cross-Site Scripting (XSS) vulnerability exists in @angular/platform-server's DOM emulation dependency (domino) when serializing the content of fallback raw-content elements (<iframe>, <noembed>, <noframes>, and <noscript>). This issue is fixed in versions 20.3.27, 21.2.19, and 22.0.7.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
angular angular
< 20.3.27affected>= 21.0.0-next.0, < 21.2.19affected>= 22.0.0-next.0, < 22.0.7affected
@angular platform-server
< 20.3.27affected>= 21.0.0-next.0, < 21.2.19affected>= 22.0.0-next.0, < 22.0.7affected
References
- https://github.com/angular/angular/security/advisories/GHSA-vpx6-8pjr-4g3v ↗
- https://github.com/angular/angular/pull/69675 ↗
- https://github.com/angular/angular/pull/69714 ↗
- https://github.com/angular/angular/pull/69929 ↗
- https://github.com/angular/angular/pull/69930 ↗
- https://github.com/angular/domino/pull/32 ↗
- https://github.com/angular/domino/commit/f88e5aa49cf2804d7c2df22ef1640eb4ec43dd56 ↗