CVE-2026-50556

A flaw was found in @angular/platform-server. This Cross-Site Scripting (XSS) vulnerability exists in its DOM emulation dependency, domino, when handling the content of <noscript> elements during server-side rendering. A remote attacker could exploit this by injecting unescaped closing </noscript> tags within dynamic text content. This allows for the execution of arbitrary code in the user's browser context, potentially leading to information disclosure or other malicious activities.

This flaw has an Important impact as @angular/platform-server's DOM emulation dependency (domino) in Red Hat products does not properly escape closing noscript tags during server-side rendering. A remote unauthenticated attacker can inject a crafted closing noscript tag into dynamic text content, which is serialized unescaped into the output HTML. When a user visits the affected page, the injected script executes in their browser context, enabling session hijacking, credential theft, or arbitrary actions on behalf of the user.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.