CVE-2026-88060: Angular platform-server SSR XSS via unescaped template in fallback elements

CVE-2026-88060 · Severity: high · CVSS 4 · Published 2026-09-10

Angular's server-side rendering (SSR) component for @angular/platform-server contains a cross-site scripting vulnerability when rendering user-supplied content within nested HTML `<template>` elements inside fallback containers like `<noscript>` or `<iframe>`. The vulnerability bypasses Angular's built-in XSS protection by failing to properly escape closing tags during HTML serialization, allowing attackers to inject malicious JavaScript that executes in the browser. This affects applications that rely on Angular's SSR to safely render untrusted data without manual sanitization.

Technologies: @angular/platform-server (npm). Vendors: npm.

Quick answers

Is CVE-2026-88060 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-88060 being exploited in the wild.
How severe is CVE-2026-88060?
High severity, with a CVSS score of 4, published 10 September 2026.
Which products and versions are affected?
@angular/platform-server (npm) SEMVER:introduced=22.0.0,fixed=22.1.4.
Is there a fix for CVE-2026-88060?
Yes. @angular/platform-server (npm): upgrade to 22.1.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-88060 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-88060?
Check whether you run @angular/platform-server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @angular/platform-server (npm): upgrade to 22.1.4 or later
    npm install @angular/platform-server@22.1.4

Technical details

The vulnerability is a cross-site scripting (XSS) flaw in the DOM serialization logic during SSR HTML generation. The root cause is that the serializer's ancestor traversal stops at `DocumentFragment` boundaries (which separate `<template>` content from the outer DOM per HTML5 spec) and fails to discover enclosing fallback raw-content elements like `<noscript>`, `<iframe>`, `<noembed>`, or `<noframes>`. In RAWTEXT parsing mode, these containers require inner closing tags to be escaped to prevent premature termination. When a `<template>` element is nested inside one of these containers, the serializer does not escape matching closing tags (e.g., `</noscript>`), allowing an attacker to inject such sequences via text interpolation (e.g., `{{ userInput }}`). The unescaped tag breaks out of the container when the HTML is parsed by a browser, causing subsequent attacker-controlled markup to execute as active DOM elements. No authentication is required; the attack vector is network-based and relies on passive user interaction (normal page rendering). Patches are available in Angular versions 20.3.30, 21.2.22, and 22.1.4; version 19 and earlier have no patch.

Affected products

  • Google @angular/platform-server >= 22.0.0, < 22.1.4
  • Google @angular/platform-server >= 21.0.0, < 21.2.22
  • Google @angular/platform-server >= 20.0.0, < 20.3.30
  • Google @angular/platform-server <= 19.2.25

Identifiers

  • CVE-2026-88060
  • GHSA-v3p8-whq6-r5jg

Timeline

  • 2026-09-10: disclosed: Public disclosure on GitHub Advisory Database
  • 2026-08-27: patched: Patches released in Angular v20.3.30, v21.2.22, v22.1.4

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.