A high-severity cross-site scripting vulnerability in Angular server-side rendering allows unauthenticated attackers to achieve arbitrary JavaScript execution in a victim's browser.

This is a cross-site scripting (CWE-79) flaw where improper neutralization of input occurs during web page generation. The vulnerability exists within the server-side rendering logic, specifically when serializing ProcessingInstruction nodes, and can be triggered by unauthenticated users if application code inserts attacker-controlled data into specific DOM containers.

Successful exploitation permits an attacker to execute malicious scripts within the context of the user session, potentially leading to unauthorized data access, session hijacking, or the defacement of web applications. With a CVSS score of 8.6, this vulnerability represents a significant risk to the integrity and confidentiality of user interactions, as it enables client-side code execution without requiring prior authentication.

Immediate Action: Update Angular to versions 20.3.30, 21.2.22, or 22.1.4 immediately to apply the necessary output escaping fixes for ProcessingInstruction nodes.

Proactive Monitoring: Review application logs for unusual input patterns involving dynamic DOM insertion or the use of Renderer2 and inject(DOCUMENT) functions that handle untrusted data.

Compensating Controls: Implement a strict Content Security Policy (CSP) that restricts script execution sources, which can mitigate the impact of injected scripts even if the vulnerability is present.

Public Exploit Available: Unknown

Given the high CVSS score and the potential for full client-side compromise, security teams should prioritize the deployment of the provided patches across all affected production environments. Because this vulnerability requires specific application-side implementation to be reachable, developers should audit existing code for instances of dynamic DOM manipulation using the vulnerable APIs mentioned in the vendor advisory.