CVE-2026-88060

Angular's server-side rendering stack (@angular/platform-server) fails to escape matching closing tags when serializing untrusted input inside template content nested in fallback raw-content elements such as noscript, iframe, noembed, and noframes, because the Domino serializer's fallbackRawContentTags traversal stops at the DocumentFragment representing template.content. An attacker who can influence interpolated values — or, unconditionally, when DOM nodes are constructed imperatively via Renderer2 — can craft input whose closing tag terminates the fallback container under HTML5 RAWTEXT parsing, causing trailing markup to be interpreted as active DOM elements. Successful abuse yields arbitrary JavaScript execution (cross-site scripting) in the browser of a user who loads the server-rendered page, consistent with the CVSS 4.0 score of 8.6, which requires user interaction. Any application using Angular SSR on versions prior to 20.3.30, 21.2.22, or 22.1.4 is affected; the bug is reachable via standard interpolation through comments or text nodes without relaxed schemas, while literal xmp or style usage additionally requires CUSTOM_ELEMENTS_SCHEMA or NO_ERRORS_SCHEMA. No public proof-of-concept or confirmed in-the-wild exploitation is known, and the issue is not listed in CISA's KEV catalog.

What to do: Upgrade Angular to 20.3.30, 21.2.22, or 22.1.4 to match your major release line. Audit SSR templates for interpolation of untrusted values inside noscript, iframe, noembed, or noframes fallback content and review any Renderer2-based imperative DOM construction, HTML-encoding or sanitizing untrusted values before they reach those containers as an interim mitigation. Note that relaxed schemas (CUSTOM_ELEMENTS_SCHEMA / NO_ERRORS_SCHEMA) with literal xmp or style elements widen the attack surface and should be checked explicitly.