Server-Side Rendering Vulnerability in Angular Platform-Server
CVE-2026-88060
8.6HIGH
What is CVE-2026-88060?
The Angular platform-server has a vulnerability that affects its server-side rendering (SSR) capabilities by improperly handling untrusted input nested within fallback raw-content elements (noscript, iframe, noembed, noframes). This flaw allows unescaped closing tags from the template.content's DocumentFragment to escape their intended boundaries. As a result, HTML5 RAWTEXT browser parsing can interpret trailing markup as active DOM elements leading to the execution of arbitrary JavaScript. The issue has been addressed in versions 20.3.30, 21.2.22, and 22.1.4.
Affected Version(s)
angular <= 19.2.25 <= 19.2.25
angular >= 20.0.0, < 20.3.30 < 20.0.0, 20.3.30
angular >= 21.0.0, < 21.2.22 < 21.0.0, 21.2.22