{"action":"Upgrade @angular/platform-server to 20.3.27 or later.","affected":[{"fixed":"22.0.7","introduced":"22.0.0-next.0"},{"fixed":"21.2.19","introduced":"21.0.0-next.0"},{"fixed":"20.3.27","introduced":"20.0.0-next.0"},{"introduced":"0","last_affected":"19.2.25"}],"component":"@angular/platform-server","cve_ids":["CVE-2026-69149"],"ecosystem":"npm","epss":0.00418,"exploited":false,"fixed_versions":["22.0.7","21.2.19","20.3.27"],"ghsa_id":"GHSA-vpx6-8pjr-4g3v","id":"tcs_01M5KGCMYMXTA7TTZWK0W1KY0Z","modified_at":"2026-08-03T16:41:45.234429Z","published_at":"2026-08-03T16:14:43Z","references":["https://osv.dev/vulnerability/GHSA-vpx6-8pjr-4g3v","https://github.com/angular/angular/security/advisories/GHSA-vpx6-8pjr-4g3v","https://github.com/angular/angular/pull/69675","https://github.com/angular/angular/pull/69714","https://github.com/angular/angular/pull/69929","https://github.com/angular/angular/pull/69930","https://github.com/angular/domino/pull/32","https://github.com/angular/domino/commit/f88e5aa49cf2804d7c2df22ef1640eb4ec43dd56","https://github.com/angular/angular"],"severity":{"label":"medium","score":6.1},"sources":[{"source":"osv","source_id":"GHSA-vpx6-8pjr-4g3v","url":"https://osv.dev/vulnerability/GHSA-vpx6-8pjr-4g3v"},{"source":"nvd","source_id":"CVE-2026-69149","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69149"}],"summary":"Angular SSR: Missing Fallback Raw-Content Serialization Escaping leads to Cross-Site Scripting (XSS)"}