CVE-2026-88060
Awaiting Analysis Awaiting Analysis - Queue

DOM-Based XSS in Angular SSR via Unescaped Raw Content

Publication date: 2026-09-10

Last updated on: 2026-09-10

Assigner: GitHub, Inc.

Description
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.30, 21.2.22, and 22.1.4, Angular server-side rendering (SSR) in @angular/platform-server serializes untrusted input inside template content nested in fallback raw-content elements such as noscript, iframe, noembed, and noframes. The Domino serializer's fallbackRawContentTags traversal stopped at the DocumentFragment used by template.content, so matching closing tags in xmp, style, script, comments, or text nodes were not escaped. Standard interpolation with comments or text nodes is reachable without relaxed schemas; literal xmp or style requires CUSTOM_ELEMENTS_SCHEMA or NO_ERRORS_SCHEMA, while Renderer2 imperative DOM construction is unconditionally affected. When HTML5 RAWTEXT browser parsing encounters the unescaped closing tag, it exits the fallback container and interprets trailing markup as active DOM elements, enabling arbitrary JavaScript execution. This issue is fixed in versions 20.3.30, 21.2.22, and 22.1.4.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-10
Last Modified
2026-09-10
Generated
2026-09-10
AI Q&A
2026-09-10
EPSS Evaluated
N/A
NVD
CVE-2026-88060
EUVD
EUVD-2026-75703

Affected Vendors & Products

Showing 6 associated CPEs
Vendor Product Version / Range
angular platform-server 20.3.30
angular platform-server 21.2.22
angular platform-server 22.1.4
angular platform-server to 20.3.30 (exc)
angular platform-server to 21.2.22 (exc)
angular platform-server to 22.1.4 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CWE-116 The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Cross-Site Scripting (XSS) vulnerability in Angular's server-side rendering (SSR) HTML serialization. When untrusted user input is rendered within raw-text tags like xmp, style, or script inside a template element nested in fallback containers such as noscript, iframe, or noembed, the serializer fails to escape closing tags. This allows the browser to prematurely exit the fallback container and execute subsequent markup as active DOM elements, enabling arbitrary JavaScript execution.

Detection Guidance

This vulnerability is specific to Angular applications using server-side rendering (SSR) with versions prior to 20.3.30, 21.2.22, and 22.1.4. Detection requires checking the Angular platform-server version in your project dependencies. Use commands like 'npm list @angular/platform-server' or 'yarn list @angular/platform-server' to identify affected versions.

Impact Analysis

An attacker could exploit this to execute malicious JavaScript in the context of a user's browser session, potentially stealing sensitive data, session cookies, or performing actions on behalf of the user. It bypasses Angular's default safety measures for text interpolation, making it dangerous even without manual sanitization.

Compliance Impact

This XSS vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality principles and HIPAA's security requirements for protected health information. Organizations using affected Angular versions may face compliance violations if exploited.

Mitigation Strategies

Upgrade Angular platform-server to version 20.3.30, 21.2.22, or 22.1.4 or later. If upgrading is not immediately possible, avoid untrusted input in raw-text tags or text nodes inside template elements nested within fallback containers like noscript or iframe.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-88060. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart