CVE-2026-88058

Angular's server-side rendering package @angular/platform-server serializes ProcessingInstruction DOM nodes inside HTML raw-text fallback elements (noscript, iframe, noembed, noframes) without escaping a matching ancestor closing tag in the instruction data. The flaw is only reachable when application or library code calls inject(DOCUMENT).createProcessingInstruction with attacker-controlled data, or inserts such nodes via Renderer2, inside one of these fallback containers during SSR; it cannot be triggered through standard Angular templates. An attacker who controls the ProcessingInstruction data can make the raw-text container close prematurely, causing following sibling markup to be parsed as live HTML and gaining arbitrary JavaScript execution (XSS) in the victim's browser, with user interaction required. Applications using Angular SSR on versions prior to 20.3.30 (20.x line), 21.2.22 (21.x line), and 22.1.4 (22.x line) are affected. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is known.

What to do: Upgrade @angular/platform-server to 20.3.30, 21.2.22, or 22.1.4 to match your Angular major release. Audit SSR code paths for inject(DOCUMENT).createProcessingInstruction or Renderer2 insertion of attacker-controlled data inside noscript, iframe, noembed, or noframes containers, and as an interim measure escape or strip angle brackets (especially matching closing tags) from ProcessingInstruction data. Prioritize applications where untrusted user input can reach ProcessingInstruction nodes during server-side rendering.