CVE-2026-69149

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.7, a Cross-Site Scripting (XSS) vulnerability exists in @angular/platform-server's DOM emulation dependency (domino) when serializing the content of fallback raw-content elements (<iframe>, <noembed>, <noframes>, and <noscript>). This issue is fixed in versions 20.3.27, 21.2.19, and 22.0.7.

• CWE-79

• https://github.com/angular/angular/pull/69675Issue Tracking
• https://github.com/angular/angular/pull/69714Issue Tracking
• https://github.com/angular/angular/pull/69929Issue Tracking
• https://github.com/angular/angular/pull/69930Issue Tracking
• https://github.com/angular/angular/security/advisories/GHSA-vpx6-8pjr-4g3vVendor Advisory, Mitigation
• https://github.com/angular/domino/commit/f88e5aa49cf2804d7c2df22ef1640eb4ec43dd56Patch
• https://github.com/angular/domino/pull/32Issue Tracking

Published

Aug 3, 2026

Last Modified

Aug 11, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-69129KubePi is a Kubernetes multi-cluster management panel. In ve…5.8
• CVE-2026-6913The Shortcodely plugin for WordPress is vulnerable to Stored…6.4
• CVE-2026-6914Computing the MD5 checksum of a malformed BSON object under …7.5
• CVE-2026-69146MLflow is an open source AI engineering platform for agents,…6.5
• CVE-2026-69147vLLM is an inference and serving engine for large language m…6.5
• CVE-2026-69148MLflow is an open source AI engineering platform for agents,…7.1
• CVE-2026-6915An authorization flaw in the user management command could a…4.3
• CVE-2026-69151Angular is a development platform for building mobile and de…6.1
• CVE-2026-69152The brace-expansion library generates arbitrary strings cont…7.5
• CVE-2026-69153PostCSS takes a CSS file and provides an API to analyze and …5.3
• CVE-2026-69159Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2026-6916The Jeg Kit for Elementor – Powerful Addons for Elementor, W…6.4