{"action":"Upgrade @angular/platform-server to 19.2.25 or later.","affected":[{"fixed":"22.0.0-rc.2","introduced":"22.0.0-next.0"},{"fixed":"21.2.16","introduced":"21.0.0-next.0"},{"fixed":"20.3.24","introduced":"20.0.0-next.0"},{"fixed":"19.2.25","introduced":"19.0.0-next.0"},{"introduced":"0","last_affected":"18.2.14"}],"component":"@angular/platform-server","cve_ids":["CVE-2026-50556"],"ecosystem":"npm","epss":0.00412,"exploited":false,"fixed_versions":["22.0.0-rc.2","21.2.16","20.3.24","19.2.25"],"ghsa_id":"GHSA-gxx4-3xcv-f8qx","id":"tcs_01M5KFSSQKNM7FPEPWQ5MQCXPF","modified_at":"2026-09-10T03:51:08.774813189Z","published_at":"2026-06-15T17:21:03Z","references":["https://osv.dev/vulnerability/GHSA-gxx4-3xcv-f8qx","https://github.com/angular/angular/security/advisories/GHSA-gxx4-3xcv-f8qx","https://github.com/angular/angular/issues/68903","https://github.com/angular/domino/pull/29","https://github.com/angular/angular"],"severity":{"label":"high"},"sources":[{"source":"osv","source_id":"GHSA-gxx4-3xcv-f8qx","url":"https://osv.dev/vulnerability/GHSA-gxx4-3xcv-f8qx"}],"summary":"@angular/platform-server: Missing `<noscript>` Raw-Text Serialization Escaping leads to Cross-Site Scripting (XSS) in Angular SSR"}