CVE-2026-88058: Angular SSR: XSS via Unescaped Processing Instruction (<?...?>) Nodes in Fallback Raw-Content Elements
An XSS vulnerability exists in @angular/platform-server during server-side rendering (SSR) HTML serialization of ProcessingInstruction DOM nodes (<?target data?>, nodeType === 7) when nested inside fallback raw-content elements (<noscript>, <iframe>, <noembed>, <noframes>). While processing instruction data escaped > to >, it did not check for or escape matching closing tags of ancestor fallback elements (e.g., </noscript>). When rendered in a browser with scripting enabled, an unescaped closing tag sequence in a processing instruction prematurely closes the fallback raw-content tag and causes subsequent sibling elements to execute as live HTML.
References
- github.com/advisories/GHSA-j3r3-mxqp-r2p4
- github.com/angular/angular/commit/73d8bbd27cb46495426d4132975a1355b47ad915
- github.com/angular/angular/commit/89b20568dfaee1ec8e0b3bcf1872acdddd2f4fef
- github.com/angular/angular/commit/ba3bc47b20b3d12f5eb141ec9c651373ae4d15e8
- github.com/angular/angular/issues/70146
- github.com/angular/angular/releases/tag/v20.3.30
- github.com/angular/angular/releases/tag/v21.2.22
- github.com/angular/angular/releases/tag/v22.1.4
- github.com/angular/angular/security/advisories/GHSA-j3r3-mxqp-r2p4
- github.com/angular/domino/commit/04f987dc08ff3736b427f50941adf1722458528f
- nvd.nist.gov/vuln/detail/CVE-2026-88058
Code Behaviors & Features
Detect and mitigate CVE-2026-88058 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →