CVE-2026-88058: Angular: SSR XSS via Unescaped Processing Instruction (<?...?>) Nodes in Fallback Raw-Content Elements
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.30, 21.2.22, and 22.1.4, Angular server-side rendering (SSR) in @angular/platform-server serializes ProcessingInstruction DOM nodes inside fallback raw-content elements without escaping matching ancestor closing tags. ProcessingInstruction data escaped greater-than characters but left less-than characters untouched and did not inspect fallback ancestors, so data such as a matching closing tag prematurely terminates noscript, iframe, noembed, or noframes containers. The vulnerable nodes cannot be authored through standard Angular templates; reachability requires application or library code using inject(DOCUMENT).createProcessingInstruction with attacker-controlled data or Renderer2 DOM insertion inside a fallback container. In HTML5 RAWTEXT parsing, the premature close causes subsequent sibling elements to be interpreted as live HTML and enables arbitrary JavaScript execution in a victim's browser. This issue is fixed in versions 20.3.30, 21.2.22, and 22.1.4.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Angular (@angular/platform-server)to a version that resolves this vulnerability.Fixed in 20.3.30 - Upgrade
Upgrade
Angular (@angular/platform-server)to a version that resolves this vulnerability.Fixed in 21.2.22 - Upgrade
Upgrade
Angular (@angular/platform-server)to a version that resolves this vulnerability.Fixed in 22.1.4
Event History
Frequently Asked Questions
Which applications are realistically exposed to this issue?
Only Angular applications using server-side rendering through @angular/platform-server are exposed, and only if application or library code creates ProcessingInstruction nodes with attacker-controlled data inside noscript, iframe, noembed, or noframes fallback containers. Standard Angular templates cannot author the vulnerable nodes.
What does an attacker need to control to exploit it?
The attacker needs control over data supplied to a ProcessingInstruction created through inject(DOCUMENT).createProcessingInstruction or inserted through Renderer2 within a fallback raw-content container. The controlled data must include a closing tag matching an ancestor fallback element, allowing later sibling content to be parsed as live HTML.
Are default Angular SSR applications affected?
The issue is not reachable through standard Angular templates alone. Exposure depends on custom application or library DOM-manipulation code that creates or inserts the affected node type in the specified fallback containers.
How can I determine whether my application is affected?
Review SSR-capable application and library code for inject(DOCUMENT).createProcessingInstruction and Renderer2 DOM insertion. Investigate cases where attacker-controlled values can reach ProcessingInstruction data inside noscript, iframe, noembed, or noframes elements.
What versions contain the fix?
Upgrade Angular to 20.3.30, 21.2.22, or 22.1.4, as applicable.