Catalogue CVE
CVE-2026-50556
Angular is a development platform for building mobile…
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-rc.2, 21.2.16, 20.3.24, and 19.2.25, a Cross-Site Scripting (XSS) vulnerability exists in @angular/platform-server's DOM emulation dependency (domino) when serializing the content of <noscript> elements. When rendering dynamic text content inside a <noscript> element via template bindings (such as {{ value }} or [textContent]), the template engine expects the browser to render the content safely. Under Server-Side Rendering (SSR), domino is configured with scripting enabled, meaning <noscript> is treated as a raw-text element. However, domino's serializer completely omitted <noscript> from the list of raw-text elements requiring closing-tag escaping during DOM serialization. As a result, any occurrence of </noscript> in the bound dynamic text was never escaped under any circumstances. The unescaped closing tag was serialized directly into the output HTML (e.g. <noscript></noscript><script>alert(1)</script></noscript>). When parsed by a browser, it closes the <noscript> block early, allowing the injected <script> block to execute in the user's browser context, causing same-origin Cross-Site Scripting (XSS). This vulnerability is fixed in 22.0.0-rc.2, 21.2.16, 20.3.24, and 19.2.25.
- Gravité
- High · CVSS 8.6
- Published
- Source
- [NVD] · [CVE record]
- EPSS
- 0.41% · Oct 27, 2026
Projects and upstream resources
Reported versions and fixes
Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.
| Distribution / release | Package | Version | Status | Source |
|---|---|---|---|---|
| Debiantrixie | angular.js | Not reported | AffectedDistribution reports no fix | [CVE-2026-50556] |
| Debiantrixie | angular.js | 1.8.3-3 | Unknown | [CVE-2026-50556] |
| Debiansid | angular.js | Not reported | AffectedDistribution reports no fix | [CVE-2026-50556] |
| Debiansid | angular.js | 1.8.3-3 | Unknown | [CVE-2026-50556] |
| Debianbookworm | angular.js | Not reported | AffectedDistribution reports no fix | [CVE-2026-50556] |
| Debianbookworm | angular.js | 1.8.3-1+deb12u1 | Unknown | [CVE-2026-50556] |
| UnknownRelease not reported | angular | Not reported | UnknownSource applicability is not established | Provider not reported |
| UnknownRelease not reported | angular | 19.2.25 | UnknownSource applicability is not established | Provider not reported |
| UnknownRelease not reported | angular | 20.3.24 | UnknownSource applicability is not established | Provider not reported |
| UnknownRelease not reported | angular | 21.2.16 | UnknownSource applicability is not established | Provider not reported |
| UnknownRelease not reported | angular.js | Not reported | UnknownSource applicability is not established | Provider not reported |
Provider details and historical evidence
| Distribution / release | Package | Version | Status | Source |
|---|---|---|---|---|
| UnknownRelease not reported | angular | Not reported | UnknownSource applicability is not established | Provider not reported |
| UnknownRelease not reported | angular | 19.2.25 | UnknownSource applicability is not established | Provider not reported |
| UnknownRelease not reported | angular | 20.3.24 | UnknownSource applicability is not established | Provider not reported |
| UnknownRelease not reported | angular | 21.2.16 | UnknownSource applicability is not established | Provider not reported |
| UnknownRelease not reported | angular.js | Not reported | UnknownSource applicability is not established | Provider not reported |
| Debianbookworm | angular.js | Not reported | AffectedDistribution reports no fix | [CVE-2026-50556] |
| Debianbookworm | angular.js | 1.8.3-1+deb12u1 | Unknown | [CVE-2026-50556] |
| Debiansid | angular.js | Not reported | AffectedDistribution reports no fix | [CVE-2026-50556] |
| Debiansid | angular.js | 1.8.3-3 | Unknown | [CVE-2026-50556] |
| Debiantrixie | angular.js | Not reported | AffectedDistribution reports no fix | [CVE-2026-50556] |
| Debiantrixie | angular.js | 1.8.3-3 | Unknown | [CVE-2026-50556] |
Original provider fields
{
"package_releases": [
{
"name": "angular.js",
"status": "unknown",
"release": "sid",
"version": "1.8.3-3"
},
{
"name": "angular.js",
"status": "unknown",
"release": "trixie",
"version": "1.8.3-3"
},
{
"name": "angular.js",
"status": "unknown",
"release": "bookworm",
"version": "1.8.3-1+deb12u1"
}
],
"fixed_versions": [
{
"bug": null,
"name": "angular.js",
"type": "source",
"origin": null,
"release": "sid",
"urgency": "not yet assigned",
"fixed_version": ""
},
{
"bug": null,
"name": "angular.js",
"type": "source",
"origin": null,
"release": "trixie",
"urgency": "not yet assigned",
"fixed_version": ""
},
{
"bug": null,
"name": "angular.js",
"type": "source",
"origin": null,
"release": "bookworm",
"urgency": "not yet assigned",
"fixed_version": ""
}
],
"distribution_packages": [
{
"name": "angular.js",
"fixed_version": "not yet fixed",
"applicability_unknown": true
},
{
"name": "angular",
"fixed_version": "",
"applicability_unknown": true
},
{
"name": "angular",
"fixed_version": "19.2.25",
"applicability_unknown": true
},
{
"name": "angular",
"fixed_version": "20.3.24",
"applicability_unknown": true
},
{
"name": "angular",
"fixed_version": "21.2.16",
"applicability_unknown": true
}
]
}OpenFactory catalog packages
L’association des paquets est en cours.
[Debian 12 (Bookworm)]
- [libjs-angularjs]Inconnu
Paquet source: [angular.js]
Détails (2)
1.8.3-1+deb12u1· all · bookwormAffectée
nvd · angular.js · debian · bookworm; nvd · angular.js · debian · 12
1.8.3-1+deb12u1· all · bookwormAffectée
nvd · angular.js · debian · bookworm; nvd · angular.js · debian · 12
[Debian 13 (Trixie)]
- [libjs-angularjs]Inconnu
Paquet source: [angular.js]
Détails (2)
1.8.3-3· all · trixieAffectée
nvd · angular.js · debian · 13
1.8.3-3· all · trixieAffectée
nvd · angular.js · debian · 13
Observé:
Références
- [https://nvd.nist.gov/vuln/detail/CVE-2026-50556]
- [https://osv.dev/vulnerability/DEBIAN-CVE-2026-50556]
- [https://security-tracker.debian.org/tracker/CVE-2026-50556]
- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-50556.json]
- [https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-1930.json]
[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]