CVE-2026-88058
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.30, 21.2.22, and 22.1.4, Angular server-side rendering (SSR) in @angular/platform-server serializes ProcessingInstruction DOM nodes inside fallback raw-content elements without escaping matching ancestor closing tags. ProcessingInstruction data escaped greater-than characters but left less-than characters untouched and did not inspect fallback ancestors, so data such as a matching closing tag prematurely terminates noscript, iframe, noembed, or noframes containers. The vulnerable nodes cannot be authored through standard Angular templates; reachability requires application or library code using inject(DOCUMENT).createProcessingInstruction with attacker-controlled data or Renderer2 DOM insertion inside a fallback container. In HTML5 RAWTEXT parsing, the premature close causes subsequent sibling elements to be interpreted as live HTML and enables arbitrary JavaScript execution in a victim's browser. This issue is fixed in versions 20.3.30, 21.2.22, and 22.1.4.
What this means for your business
- FIRST's prediction model gives it a 0.5% chance of attack attempts being seen in the next 30 days, ranking above 41% of all known flaws.
What to do
- 1Ask your IT team or provider whether any of your systems use the affected product.
- 2If you do, follow the vendor's guidance. No patch reference has been published yet.
Not sure if your company is exposed?
Fastnexa’s certified penetration testers can check whether attackers could use this flaw, or others like it, against your websites, apps and network. The full test is free for our first 10 founding clients until 31 December 2026.
Scoring
- CVSS
- Not yet scored
- CVSS v4
- 8.6
- Weakness
- CWE-79
- Assigned by
- security-advisories@github.com
Dates
- Published
- 2026-09-10
- Last modified
- 2026-09-11
- Sources
- NVD
References
- https://github.com/angular/angular/commit/73d8bbd27cb46495426d4132975a1355b47ad915
- https://github.com/angular/angular/commit/89b20568dfaee1ec8e0b3bcf1872acdddd2f4fef
- https://github.com/angular/angular/commit/ba3bc47b20b3d12f5eb141ec9c651373ae4d15e8
- https://github.com/angular/angular/issues/70146
- https://github.com/angular/angular/releases/tag/v20.3.30
- https://github.com/angular/angular/releases/tag/v21.2.22
- https://github.com/angular/angular/releases/tag/v22.1.4
- https://github.com/angular/angular/security/advisories/GHSA-j3r3-mxqp-r2p4
- https://github.com/angular/domino/commit/04f987dc08ff3736b427f50941adf1722458528f
- https://github.com/angular/angular/issues/70146
- https://github.com/angular/angular/security/advisories/GHSA-j3r3-mxqp-r2p4