CVE-2026-88058

Overview

Angular is a TypeScript-based web development platform for building scalable single-page and server-side rendered applications. It provides a modular architecture, powerful dependency injection, and built-in tools for building modern, performant, and maintainable applications across web, mobile, and desktop environments.

A Cross-Site Scripting (XSS) vulnerability (CVE-2026-88058) has been identified in Angular's Platform Server, which allows attackers to break out of fallback raw-content elements during server-side rendering through unescaped processing instruction nodes and can lead to arbitrary JavaScript execution within the context of the victim's browser session.

Per OWASP, this vulnerability falls under Stored Cross-Site Scripting. Stored XSS occurs when an application stores untrusted input and later renders it without proper neutralization. In this case, the injected payload may execute when a user interacts with the affected element or automatically when an animation is triggered.

This issue affects multiple versions of Angular.

‍

Details

Module Info

• Product: Angular
• Affected packages: @angular/platform-server
• Affected versions:
  • >=5.0.0-beta.6 <=19.2.25
  • >=20.0.0 <20.3.30
  • >=21.0.0 <21.2.22
  • >=22.0.0 <22.1.4
• GitHub repository: https://github.com/angular/angular
• Published packages: https://www.npmjs.com/package/@angular/platform-server
• Package manager: npm
• Fixed in:
  • OSS Angular v20.3.30, v21.2.22 and v22.1.4
  • NES for Angular v19.2.30, v18.2.26, v17.3.26, v16.2.26, v15.2.24, v14.3.15, v13.4.17, v12.3.11, v11.2.29, v10.2.21, v9.1.27, v8.2.27, v7.2.28, v6.1.23, v5.2.22

Vulnerability Info

This High-severity vulnerability is found in the @angular/platform-server package in multiple published versions of Angular. The underlying defect is in domino, the DOM emulation dependency that Platform Server uses to serialize rendered HTML on the server.

An XSS vulnerability exists in @angular/platform-server during server-side rendering (SSR) HTML serialization of ProcessingInstruction DOM nodes (<?target data?>, nodeType === 7) when nested inside fallback raw-content elements (<noscript>, <iframe>, <noembed>, <noframes>). While processing instruction data escaped > to &gt;, it did not check for or escape matching closing tags of ancestor fallback elements, such as </noscript>. When rendered in a browser with scripting enabled, an unescaped closing tag sequence in a processing instruction prematurely closes the fallback raw-content tag and causes subsequent sibling elements to execute as live HTML.

In HTML5 parsing, fallback raw-content elements place the browser's HTML tokenizer into RAWTEXT mode. In RAWTEXT mode, processing instruction tokens (<?...?>) are treated as literal raw text rather than bogus comments, and the parser ignores > or ?>. The only token sequence that terminates the container is an end tag matching the container tag name, such as </noscript or </iframe.

During server-side HTML serialization, processing instruction nodes previously only replaced > with &gt;, which prevents bogus comment breakouts in normal HTML data states, but left < untouched. Crucially, processing instruction serialization never inspected ancestor fallback raw-content tags. As a result, if a ProcessingInstruction node inside <noscript> contained </noscript in its data payload, it was emitted unescaped as <?x </noscript ?>.

Processing instruction nodes cannot be authored directly through standard Angular template syntax, which parses <?...> into comment nodes in DOM position. This vulnerability is reached where application or library code calls inject(DOCUMENT).createProcessingInstruction(target, data) or Renderer2 DOM insertion methods with untrusted user input passed to data inside a fallback raw-content container. In applications that programmatically construct processing instruction nodes inside fallback elements during server-side rendering, an attacker controlling the processing instruction data can break out of the container and execute arbitrary JavaScript in victims' browsers.

‍

Mitigation

Angular versions prior to 20 were already End-of-Life when this CVE was published and will not receive any updates to address this issue. For more information see here.

Users of the affected components should apply one of the following mitigations:

• Migrate affected applications to a patched version of Angular.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.

‍

Credits

• VenkatKwest (finder)