Angular Server-Side Rendering Vulnerability Affecting Angular Framework
CVE-2026-88058
8.6HIGH
What is CVE-2026-88058?
The vulnerability in Angular’s server-side rendering allows ProcessingInstruction DOM nodes to be serialized without properly escaping certain characters. This can lead to premature termination of HTML elements, enabling attackers to inject malicious JavaScript into web applications. The issue arises when using application or library code that exploits the unsafe use of inject(DOCUMENT).createProcessingInstruction with untrusted data. Users are advised to upgrade to the patched versions 20.3.30, 21.2.22, and 22.1.4 to mitigate this risk.
Affected Version(s)
angular <= 19.2.25 <= 19.2.25
angular >= 20.0.0, < 20.3.30 < 20.0.0, 20.3.30
angular >= 21.0.0, < 21.2.22 < 21.0.0, 21.2.22