An unauthenticated remote attacker can achieve arbitrary JavaScript execution in Angular applications due to an improper input neutralization flaw in the server-side rendering process.

This is a cross-site scripting (XSS) vulnerability occurring when the Domino serializer fails to escape closing tags within specific HTML5 raw-content elements. Because the serializer does not properly neutralize input nested in these elements, an unauthenticated attacker can supply crafted input that causes the browser to exit the container and execute malicious scripts.

Successful exploitation allows for the execution of arbitrary JavaScript in the context of the user session. This can lead to the theft of session tokens, unauthorized actions performed on behalf of the user, and potential compromise of sensitive data displayed within the application. Given the CVSS score of 8.6, this vulnerability represents a high risk to application integrity and user confidentiality.

Immediate Action: Update the @angular/platform-server package to version 20.3.30, 21.2.22, or 22.1.4 respectively, based on your current development branch.

Proactive Monitoring: Review web application firewall logs for unusual script injection patterns or unexpected characters within input parameters that interact with server-side rendered templates.

Compensating Controls: Implement a strict Content Security Policy (CSP) to restrict the execution of unauthorized scripts and mitigate the impact of potential XSS attacks if immediate patching is not feasible.

Public Exploit Available: Unknown

This vulnerability presents a high risk of cross-site scripting due to the nature of server-side rendering flaws. Organizations utilizing Angular should prioritize upgrading to the patched versions immediately to ensure that untrusted input is properly neutralized during the serialization process.