XSS in @Angular Platform-server

CVE-2026-69149

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.7, a Cross-Site Scripting (XSS) vulnerability exists in @angular/platfo…

Vulnerability class: XSS (Cross-Site Scripting)

Affected products

  • @Angular Platform-server — versions < 20.3.27, >= 21.0.0-next.0, < 21.2.19, >= 22.0.0-next.0, < 22.0.7
  • Angular — versions < 20.3.27, >= 21.0.0-next.0, < 21.2.19, >= 22.0.0-next.0, < 22.0.7

Weakness classification (CWE)

References