Angular: SSR XSS via Unescaped Processing Instruction () Nodes in Fallback Raw-Content Elements
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.30, 21.2.22, and 22.1.4, Angular server-side rendering (SSR) in @angular/platform-server serializes ProcessingInstruction DOM nodes inside fallback raw-content elements without escaping matching ancestor closing tags. ProcessingInstruction data escaped greater-than characters but left less-than characters untouched and did not inspect fallback ancestors, so data such as a matching closing tag prematurely terminates noscript, iframe, noembed, or noframes containers. The vulnerable nodes cannot be authored through standard Angular templates; reachability requires application or library code using inject(DOCUMENT).createProcessingInstruction with attacker-controlled data or Renderer2 DOM insertion inside a fallback container. In HTML5 RAWTEXT parsing, the premature close causes subsequent sibling elements to be interpreted as live HTML and enables arbitrary JavaScript execution in a victim's browser. This issue is fixed in versions 20.3.30, 21.2.22, and 22.1.4.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-88058
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 7 Nov 2026, 04:54 UTC · Revision 1
Source evidence
Angular: SSR XSS via Unescaped Processing Instruction () Nodes in Fallback Raw-Content Elements
core-osv · Original sourcePublished 10 Sept 2026, 18:56 UTC
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.30, 21.2.22, and 22.1.4, Angular server-side rendering (SSR) in @angular/platform-server serializes ProcessingInstruction DOM nodes inside fallback raw-content elements without escaping matching ancestor closing tags. ProcessingInstruction data escaped greater-than characters but left less-than characters untouched and did not inspect fallback ancestors, so data such as a matching closing tag prematurely terminates noscript, iframe, noembed, or noframes containers. The vulnerable nodes cannot be authored through standard Angular templates; reachability requires application or library code using inject(DOCUMENT).createProcessingInstruction with attacker-controlled data or Renderer2 DOM insertion inside a fallback container. In HTML5 RAWTEXT parsing, the premature close causes subsequent sibling elements to be interpreted as live HTML and enables arbitrary JavaScript execution in a victim's browser. This issue is fixed in versions 20.3.30, 21.2.22, and 22.1.4.
osv:CVE-2026-88058
Complete source record
{
"id": "32b75a2e0118432f84f4b5b6dd786d0f74e7167676cb37ba5525434f9b073803",
"url": "https://osv.dev/vulnerability/CVE-2026-88058",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Angular: SSR XSS via Unescaped Processing Instruction () Nodes in Fallback Raw-Content Elements",
"summary": "Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.30, 21.2.22, and 22.1.4, Angular server-side rendering (SSR) in @angular/platform-server serializes ProcessingInstruction DOM nodes inside fallback raw-content elements without escaping matching ancestor closing tags. ProcessingInstruction data escaped greater-than characters but left less-than characters untouched and did not inspect fallback ancestors, so data such as a matching closing tag prematurely terminates noscript, iframe, noembed, or noframes containers. The vulnerable nodes cannot be authored through standard Angular templates; reachability requires application or library code using inject(DOCUMENT).createProcessingInstruction with attacker-controlled data or Renderer2 DOM insertion inside a fallback container. In HTML5 RAWTEXT parsing, the premature close causes subsequent sibling elements to be interpreted as live HTML and enables arbitrary JavaScript execution in a victim's browser. This issue is fixed in versions 20.3.30, 21.2.22, and 22.1.4.",
"evidence": "osv:CVE-2026-88058",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2026-88058",
"aliases": [
"CVE-2026-88058",
"GHSA-j3r3-mxqp-r2p4"
],
"metrics": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/angular/angular",
"type": "GIT",
"events": [
{
"introduced": "e7566c3c475560616f97de2ab3c8f8d6f83be015"
},
{
"last_affected": "6d1753b46b7389c10aa17da2327043fbf5296035"
},
{
"introduced": "40e2b5b4d13792ed7c46a1d22afcf6c12ac9c679"
},
{
"fixed": "4ee0421f0c4c84d9042bc94cf9613d005f8f9505"
},
{
"introduced": "00dcbf2eeb3fd18ed39148e4bc9e49a5b35cae0c"
},
{
"fixed": "4c0bc4345a41ab48d8361e0bff18191da9c8c065"
},
{
"introduced": "862d27f25c4d3bf2fe2918b76759f3f4a83563d1"
},
{
"fixed": "898380974d49cf7976e9d89cc74a0801a26ce7b1"
},
{
"fixed": "73d8bbd27cb46495426d4132975a1355b47ad915"
},
{
"fixed": "89b20568dfaee1ec8e0b3bcf1872acdddd2f4fef"
},
{
"fixed": "ba3bc47b20b3d12f5eb141ec9c651373ae4d15e8"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:angular:angular:*:*:*:*:*:node.js:*:*",
"range": [
{
"introduced": "19.0.0"
},
{
"last_affected": "19.2.25"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:angular:angular:*:*:*:*:*:node.js:*:*",
"range": [
{
"introduced": "20.0.0"
},
{
"fixed": "20.3.30"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:angular:angular:*:*:*:*:*:node.js:*:*",
"range": [
{
"introduced": "21.0.0"
},
{
"fixed": "21.2.22"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:angular:angular:*:*:*:*:*:node.js:*:*",
"range": [
{
"introduced": "22.0.0"
},
{
"fixed": "22.1.4"
}
],
"source": "CPE_RANGE"
},
{
"range": [
{
"fixed": "73d8bbd27cb46495426d4132975a1355b47ad915"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"fixed": "89b20568dfaee1ec8e0b3bcf1872acdddd2f4fef"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"fixed": "ba3bc47b20b3d12f5eb141ec9c651373ae4d15e8"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"fixed": "4ee0421f0c4c84d9042bc94cf9613d005f8f9505"
}
],
"source": "REFERENCES_TAG",
"original_tag": "v20.3.30"
},
{
"range": [
{
"fixed": "4c0bc4345a41ab48d8361e0bff18191da9c8c065"
}
],
"source": "REFERENCES_TAG",
"original_tag": "v21.2.22"
},
{
"range": [
{
"fixed": "898380974d49cf7976e9d89cc74a0801a26ce7b1"
}
],
"source": "REFERENCES_TAG",
"original_tag": "v22.1.4"
}
]
}
},
{
"repo": "https://github.com/angular/domino",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "04f987dc08ff3736b427f50941adf1722458528f"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"fixed": "04f987dc08ff3736b427f50941adf1722458528f"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-88058.json"
}
}
],
"modified": "2026-10-28T02:30:49.788208465Z",
"provider": "osv",
"references": [
"https://github.com/angular/angular/releases/tag/v20.3.30",
"https://github.com/angular/angular/releases/tag/v21.2.22",
"https://github.com/angular/angular/releases/tag/v22.1.4",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/88xxx/CVE-2026-88058.json",
"https://github.com/angular/angular/security/advisories/GHSA-j3r3-mxqp-r2p4",
"https://nvd.nist.gov/vuln/detail/CVE-2026-88058",
"https://github.com/angular/angular/issues/70146",
"https://github.com/angular/angular/commit/73d8bbd27cb46495426d4132975a1355b47ad915",
"https://github.com/angular/angular/commit/89b20568dfaee1ec8e0b3bcf1872acdddd2f4fef",
"https://github.com/angular/angular/commit/ba3bc47b20b3d12f5eb141ec9c651373ae4d15e8",
"https://github.com/angular/domino/commit/04f987dc08ff3736b427f50941adf1722458528f"
],
"provider_metadata": {
"cwe_ids": [
"CWE-116",
"CWE-79"
],
"cna_assigner": "GitHub_M",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/88xxx/CVE-2026-88058.json"
}
},
"related_cves": [
{
"value": "CVE-2026-88058",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 518294,
"published_at": "2026-09-10T18:56:03.369+00:00"
}