Is CVE-2026-88058 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-88058 being exploited in the wild.

How severe is CVE-2026-88058?

High severity, with a CVSS score of 4, published 10 September 2026.

Which products and versions are affected?

@angular/platform-server (npm) SEMVER:introduced=22.0.0,fixed=22.1.4.

Is there a fix for CVE-2026-88058?

Yes. @angular/platform-server (npm): upgrade to 22.1.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-88058 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-88058?

Check whether you run @angular/platform-server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-88058: Angular platform-server XSS via ProcessingInstruction DOM serialization

CVE-2026-88058 · Severity: high · CVSS 4 · Published 2026-09-10

Angular's server-side rendering (SSR) module can improperly serialize DOM nodes when building web applications, leaving attacker-controlled content unescaped. This allows an attacker to inject malicious JavaScript that executes in a user's browser, potentially stealing session data, modifying page content, or performing actions on behalf of the victim.

Technologies: @angular/platform-server (npm). Vendors: npm.

Quick answers

Is CVE-2026-88058 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-88058 being exploited in the wild.
How severe is CVE-2026-88058?: High severity, with a CVSS score of 4, published 10 September 2026.
Which products and versions are affected?: @angular/platform-server (npm) SEMVER:introduced=22.0.0,fixed=22.1.4.
Is there a fix for CVE-2026-88058?: Yes. @angular/platform-server (npm): upgrade to 22.1.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-88058 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-88058?: Check whether you run @angular/platform-server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@angular/platform-server (npm): upgrade to 22.1.4 or later
```
npm install @angular/platform-server@22.1.4
```

Technical details

The vulnerability is a cross-site scripting (XSS) flaw in Angular's @angular/platform-server module. When serializing ProcessingInstruction DOM nodes within fallback raw-content elements (such as noscript, iframe, noembed, or noframes), the module fails to properly escape less-than characters and does not inspect parent closing tags. An attacker can inject a ProcessingInstruction with matching closing tag data via inject(DOCUMENT).createProcessingInstruction() or Renderer2 DOM insertion, which prematurely closes the fallback container in HTML5 RAWTEXT parsing mode. This causes subsequent sibling elements to be interpreted as executable HTML, enabling arbitrary JavaScript execution. The issue requires application code to explicitly use createProcessingInstruction with attacker-controlled input. The vulnerability is fixed in Angular 20.3.30, 21.2.22, and 22.1.4.

Affected products

Google Angular Prior to 20.3.30, 21.2.22, and 22.1.4

Identifiers

CVE-2026-88058
GHSA-j3r3-mxqp-r2p4

Timeline

2026-09-10: disclosed
2026-09-10: patched: Angular 20.3.30, 21.2.22, and 22.1.4 include fixes

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.