{"action":"Upgrade @angular/platform-server to 19.2.25 or later.","affected":[{"fixed":"22.0.0-rc.2","introduced":"22.0.0-next.0"},{"fixed":"21.2.16","introduced":"21.0.0-next.0"},{"fixed":"20.3.24","introduced":"20.0.0-next.0"},{"fixed":"19.2.25","introduced":"19.0.0-next.0"},{"introduced":"0","last_affected":"18.2.14"}],"component":"@angular/platform-server","cve_ids":["CVE-2026-50555"],"ecosystem":"npm","epss":0.00267,"exploited":false,"fixed_versions":["22.0.0-rc.2","21.2.16","20.3.24","19.2.25"],"ghsa_id":"GHSA-hqr9-c56f-3x7f","id":"tcs_01M5KFVWFS147SS5TW7WCZ35X7","modified_at":"2026-07-15T22:30:44.479047859Z","published_at":"2026-06-15T17:20:30Z","references":["https://osv.dev/vulnerability/GHSA-hqr9-c56f-3x7f","https://github.com/angular/angular/security/advisories/GHSA-hqr9-c56f-3x7f","https://nvd.nist.gov/vuln/detail/CVE-2026-50555","https://github.com/angular/domino/pull/29","https://github.com/angular/angular"],"severity":{"label":"medium","score":6.1},"sources":[{"source":"osv","source_id":"GHSA-hqr9-c56f-3x7f","url":"https://osv.dev/vulnerability/GHSA-hqr9-c56f-3x7f"}],"summary":"@angular/platform-server: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}