CVE-2026-88058
Awaiting Analysis Awaiting Analysis - Queue

DOM Clobbering in Angular SSR via ProcessingInstruction

Publication date: 2026-09-10

Last updated on: 2026-09-10

Assigner: GitHub, Inc.

Description
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.30, 21.2.22, and 22.1.4, Angular server-side rendering (SSR) in @angular/platform-server serializes ProcessingInstruction DOM nodes inside fallback raw-content elements without escaping matching ancestor closing tags. ProcessingInstruction data escaped greater-than characters but left less-than characters untouched and did not inspect fallback ancestors, so data such as a matching closing tag prematurely terminates noscript, iframe, noembed, or noframes containers. The vulnerable nodes cannot be authored through standard Angular templates; reachability requires application or library code using inject(DOCUMENT).createProcessingInstruction with attacker-controlled data or Renderer2 DOM insertion inside a fallback container. In HTML5 RAWTEXT parsing, the premature close causes subsequent sibling elements to be interpreted as live HTML and enables arbitrary JavaScript execution in a victim's browser. This issue is fixed in versions 20.3.30, 21.2.22, and 22.1.4.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-10
Last Modified
2026-09-10
Generated
2026-09-10
AI Q&A
2026-09-10
EPSS Evaluated
N/A
NVD
CVE-2026-88058
EUVD
EUVD-2026-75681

Affected Vendors & Products

Showing 10 associated CPEs
Vendor Product Version / Range
angular platform-server 20.3.30
angular platform-server 21.2.22
angular platform-server 22.1.4
angular platform-server to 20.3.30 (inc)
angular platform-server to 21.2.22 (inc)
angular platform-server to 22.1.4 (inc)
angular platform-server From 20.0.0 (inc) to 22.1.4 (exc)
angular platform-server From 21.0.0 (inc) to 21.2.22 (exc)
angular platform-server From 22.0.0 (inc) to 22.1.4 (exc)
angular platform-server to 19.2.25 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CWE-116 The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-88058 is an XSS vulnerability in Angular's server-side rendering (SSR) where ProcessingInstruction DOM nodes (like <?target data?>) are improperly serialized inside fallback raw-content elements such as noscript, iframe, noembed, or noframes. The serialization escapes > characters but not <, allowing unescaped closing tags to prematurely terminate these elements. This exposes subsequent sibling elements as live HTML, enabling arbitrary JavaScript execution in a victim's browser.

Detection Guidance

To detect this vulnerability, inspect Angular applications using server-side rendering (SSR) with @angular/platform-server versions between 20.0.0-22.1.3, 21.0.0-21.2.21, or 22.0.0-22.1.3. Check for processing instruction nodes created via document.createProcessingInstruction() or Renderer2 within fallback raw-content elements like noscript, iframe, noembed, or noframes. Review server logs for suspicious HTML output containing unescaped closing tags.

Impact Analysis

This vulnerability allows attackers to execute arbitrary JavaScript in users' browsers by injecting malicious payloads via ProcessingInstruction nodes. If exploited, it could lead to session hijacking, data theft, or defacement of affected websites. The attack requires attacker-controlled input passed through document.createProcessingInstruction() or Renderer2 within fallback raw-content containers.

Mitigation Strategies

Upgrade @angular/platform-server to versions 20.3.30, 21.2.22, or 22.1.4 or later. Avoid untrusted input in processing instruction nodes within fallback containers. Manually sanitize less-than characters to &lt; in processing instruction data. Disable SSR if not required or use Content Security Policy headers to mitigate XSS risks.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-88058. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart