CVE-2026-50556

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-rc.2, 21.2.16, 20.3.24, and 19.2.25, a Cross-Site Scripting (XSS) vulnerability exists in @angular/platform-server's DOM emulation dependency (domino) when serializing the content of <noscript> elements. When rendering dynamic text content inside a <noscript> element via template bindings (such as {{ value }} or [textContent]), the template engine expects the browser to render the content safely. Under Server-Side Rendering (SSR), domino is configured with scripting enabled, meaning <noscript> is treated as a raw-text element. However, domino's serializer completely omitted <noscript> from the list of raw-text elements requiring closing-tag escaping during DOM serialization. As a result, any occurrence of </noscript> in the bound dynamic text was never escaped under any circumstances. The unescaped closing tag was serialized directly into the output HTML (e.g. <noscript></noscript><script>alert(1)</script></noscript>). When parsed by a browser, it closes the <noscript> block early, allowing the injected <script> block to execute in the user's browser context, causing same-origin Cross-Site Scripting (XSS). This vulnerability is fixed in 22.0.0-rc.2, 21.2.16, 20.3.24, and 19.2.25.

• CWE-79
• CWE-79

• https://github.com/angular/angular/issues/68903Issue Tracking
• https://github.com/angular/angular/security/advisories/GHSA-gxx4-3xcv-f8qxThird Party Advisory
• https://github.com/angular/domino/pull/29Issue Tracking, Patch
• https://access.redhat.com/security/cve/CVE-2026-50556Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=2491459Third Party Advisory
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-50556.jsonThird Party Advisory

Published

Jun 22, 2026

Last Modified

Jul 15, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-50548Cursor is a code editor built for programming with AI. Prior…9.8
• CVE-2026-50549Cursor is a code editor built for programming with AI. Prior…9.8
• CVE-2026-5055NoMachine Uncontrolled Search Path Element Local Privilege E…7.8
• CVE-2026-50551SiYuan is an open-source personal knowledge management syste…9.9
• CVE-2026-50552Koel is a free, open-source music streaming solution. Prior …6.3
• CVE-2026-50555Angular is a development platform for building mobile and de…6.1
• CVE-2026-50557Angular is a development platform for building mobile and de…6.1
• CVE-2026-50558Penelope Shell Handler is a post-exploitation shell handler …5.9
• CVE-2026-50559Quarkus is a Java framework for building cloud-native applic…7.5
• CVE-2026-5056GStreamer qtdemux Stack-based Buffer Overflow Remote Code Ex…7.8
• CVE-2026-50560Netty is a network application framework for development of …5.3
• CVE-2026-50561Yuxi is a large-model-based intelligent knowledge base and k…9.4