CVE-2026-88060

Overview

Angular is a TypeScript-based web development platform for building scalable single-page and server-side rendered applications. It provides a modular architecture, powerful dependency injection, and built-in tools for building modern, performant, and maintainable applications across web, mobile, and desktop environments.

A Cross-Site Scripting (XSS) vulnerability (CVE-2026-88060) has been identified in Angular's Platform Server, which allows attackers to break out of fallback raw-content elements during server-side rendering through untrusted input placed inside a nested <template> element and can lead to arbitrary JavaScript execution within the context of the victim's browser session.

Per OWASP, this vulnerability falls under Stored Cross-Site Scripting. Stored XSS occurs when an application stores untrusted input and later renders it without proper neutralization. In this case, the injected payload may execute when a user interacts with the affected element or automatically when an animation is triggered.

This issue affects multiple versions of Angular.

Details

Module Info

• Product: Angular
• Affected packages: @angular/platform-server
• Affected versions:
  • >=5.0.0-beta.6 <=19.2.25
  • >=20.0.0 <20.3.30
  • >=21.0.0 <21.2.22
  • >=22.0.0 <22.1.4
• GitHub repository: https://github.com/angular/angular
• Published packages: https://www.npmjs.com/package/@angular/platform-server
• Package manager: npm
• Fixed in:
  • NES for Angular v19.2.30, v18.2.26, v17.3.26, v16.2.26, v15.2.24, v14.3.15, v13.4.17, v12.3.11, v11.2.29, v10.2.21, v9.1.27, v8.2.27, v7.2.28, v6.1.23, v5.2.22
  • OSS Angular v20.3.30, v21.2.22 and v22.1.4

Vulnerability Info

This High-severity vulnerability is found in the @angular/platform-server package in multiple published versions of Angular. The underlying defect is in domino, the DOM emulation dependency that Platform Server uses to serialize rendered HTML on the server.

An XSS vulnerability exists in @angular/platform-server during server-side rendering (SSR) HTML serialization when traversing ancestor tags across <template> element boundaries. When an application renders untrusted user input within raw-text tags (<xmp>, <style>, <script>), comments, or text nodes inside a <template> that is nested within a fallback raw-content element (<noscript>, <iframe>, <noembed>, <noframes>), matching closing tags such as </noscript> are not escaped during HTML serialization. When rendered in a browser, this unescaped closing tag prematurely terminates the fallback container and executes trailing markup as active DOM elements.

In HTML5 parsing, fallback raw-content elements place the browser's tokenizer into RAWTEXT mode. In this mode, inner content is parsed as literal text until an end tag matching the container tag name, such as </noscript>, is encountered.

To prevent XSS breakout vectors during SSR serialization, the DOM serializer inspects a node's ancestors to escape any matching fallback closing tags, rewriting </tag to &lt;/tag. However, per DOM specifications, the children of a <template> element reside in a separate DocumentFragment (template.content), whose own parentNode is null. The serializer's ancestor traversal previously only inspected element nodes, so when traversing upward from a node inside template.content, traversal terminated immediately at the DocumentFragment boundary. Because traversal stopped before reaching the outer document tree, enclosing fallback raw-content ancestors such as <noscript> or <iframe> were not discovered, and closing sequences like </noscript> within <template> content were emitted unescaped.

Angular guarantees that standard text interpolation ({{ userInput }} bound as element text content) is safe by default without manual sanitization. This vulnerability bypasses that guarantee during SSR HTML serialization when untrusted input is interpolated inside template content within fallback containers. Writing literal <xmp> or <style> directly inside a component's <template> markup requires relaxed template schema checks (CUSTOM_ELEMENTS_SCHEMA or NO_ERRORS_SCHEMA), while standard HTML comments and text nodes inside <template> within <noscript> are reachable without relaxed schemas. Components or directives that construct DOM structures imperatively via Renderer2 bypass template compiler schema checks entirely and are unconditionally affected.

Mitigation

Angular versions prior to 20 were already End-of-Life when this CVE was published and will not receive any updates to address this issue. For more information see here.

Users of the affected components should apply one of the following mitigations:

• Migrate affected applications to a patched version of Angular.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.

Credits

• Mabjr33