CVE-2026-88058
CVE-2026-88058 — Angular: SSR XSS via Unescaped Processing Instruction (<?...?>) Nodes in Fallback Raw-Content Elements
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.30, 21.2.22, and 22.1.4, Angular server-side rendering (SSR) in @angular/platform-server serializes ProcessingInstruction DOM nodes inside fallback raw-content elements without escaping matching ancestor closing tags. ProcessingInstruction data escaped greater-than characters but left less-than characters untouched and did not inspect fallback ancestors, so data such as a matching closing tag prematurely terminates noscript, iframe, noembed, or noframes containers. The vulnerable nodes cannot be authored through standard Angular templates; reachability requires application or library code using inject(DOCUMENT).createProcessingInstruction with attacker-controlled data or Renderer2 DOM insertion inside a fallback container. In HTML5 RAWTEXT…
Published Updated Sources: cvelistV5, GitHub_M
Triage
Is it exploited, how likely is exploitation, what does it touch, and how severe do the scoring sources call it.
Exploitation
Unreported
no source claims exploitation
EPSS
0%
chance of exploitation in 30 days
CVSS base
8.6
HIGH
CISA SSVC assessment
Three decision points CISA publishes for the CVEs it assesses · SSVC 2.0.3. A stakeholder decision, not a severity score.
Exploitation
PoC
none · proof-of-concept · active
Automatable
No
can an attacker script all four kill-chain steps
Technical impact
Total
partial · total control of the vulnerable component
Affected scope
The catalog records vendors and products as separate lists, not pairs, so which product belongs to which vendor is not something this page can say.
Vendors (1)
Products (1)
Every base score collected
Sources score independently and disagree; each row says who scored it and under which version.
| Score | Version | Severity | Expl. | Impact | Source |
|---|---|---|---|---|---|
| 8.6 | CVSS 4.0 | HIGH | — | — | cvelistV5 |
Weakness & attack patterns
- CWE-79
- CWE-116
Detection
Read off the CVSS vector and the weakness class. Starting points, not rules we have tested.
- Search application, proxy, and WAF logs for requests touching /JavaScript, /platform-server.
References
9 on the record
- github.com/angular/angular/security/advisories/GHSA-j3r3-mxqp-r2p4
x_refsource_CONFIRM
- github.com/angular/angular/issues/70146
x_refsource_MISC
- github.com/angular/angular/commit/73d8bbd27cb46495426d4132975a1355b47ad915
x_refsource_MISC
- github.com/angular/angular/commit/89b20568dfaee1ec8e0b3bcf1872acdddd2f4fef
x_refsource_MISC
- github.com/angular/angular/commit/ba3bc47b20b3d12f5eb141ec9c651373ae4d15e8
x_refsource_MISC
- github.com/angular/domino/commit/04f987dc08ff3736b427f50941adf1722458528f
x_refsource_MISC
- github.com/angular/angular/releases/tag/v20.3.30
x_refsource_MISC
- github.com/angular/angular/releases/tag/v21.2.22
x_refsource_MISC
Elsewhere on this site
Not in any source we poll
Listed rather than left blank: an empty field and an unmeasured one look identical on screen, and only one is a reason to look elsewhere.
- No confirmed IOCs, IP addresses, domains, file hashes, or malware artifacts supplied.
- No organization-specific asset inventory, compensating-control status, or patch deployment evidence supplied.
- No exploit packet captures, log samples, or incident case IDs supplied.