A high-severity Cross-site Scripting (XSS) vulnerability in Angular allows attackers to execute arbitrary scripts in the context of a user session.

The platform fails to properly neutralize input during web page generation (CWE-79), leading to XSS. The attack is unauthenticated but requires user interaction, such as a victim navigating to a crafted page.

With a CVSS score of 8.6, this vulnerability poses a severe threat to user security. An attacker can steal session cookies, perform unauthorized actions on behalf of the user, or deface the application, which could lead to substantial reputational damage and loss of user trust.

Immediate Action: Upgrade the @angular/platform-server package to version 20.3.27, 21.2.19, or 22.0.7 to resolve the input neutralization flaw.

Proactive Monitoring: Monitor web traffic for anomalous script injection attempts or suspicious URL parameters that might be used to deliver XSS payloads.

Compensating Controls: Deploy a robust Content Security Policy (CSP) to restrict the execution of unauthorized scripts and mitigate the impact of potential XSS attacks.

Public Exploit Available: Unknown

XSS remains a primary vector for account compromise. Security teams must ensure that all production environments are updated to the patched versions immediately to prevent potential session hijacking and unauthorized data access.