CVE-2026-88058: Angular SSR: XSS via Unescaped Processing Instruction (<?...?>) Nodes in Fallback Raw-Content Elements
An XSS vulnerability exists in @angular/platform-server during server-side rendering (SSR) HTML serialization of ProcessingInstruction DOM nodes (<?target data?>, nodeType === 7) when nested inside fallback raw-content elements (<noscript>, <iframe>, <noembed>, <noframes>). While processing instruction data escaped > to >, it did not check for or escape matching closing tags of ancestor fallback elements (e.g., </noscript>). When rendered in a browser with scripting enabled, an unescaped closing tag sequence in a processing instruction prematurely closes the fallback raw-content tag and causes subsequent sibling elements to execute as live HTML.
References
- github.com/advisories/GHSA-j3r3-mxqp-r2p4
- github.com/angular/angular/commit/73d8bbd27cb46495426d4132975a1355b47ad915
- github.com/angular/angular/commit/89b20568dfaee1ec8e0b3bcf1872acdddd2f4fef
- github.com/angular/angular/commit/ba3bc47b20b3d12f5eb141ec9c651373ae4d15e8
- github.com/angular/angular/issues/70146
- github.com/angular/angular/releases/tag/v20.3.30
- github.com/angular/angular/releases/tag/v21.2.22
- github.com/angular/angular/releases/tag/v22.1.4
- github.com/angular/angular/security/advisories/GHSA-j3r3-mxqp-r2p4
- github.com/angular/domino/commit/04f987dc08ff3736b427f50941adf1722458528f
- nvd.nist.gov/vuln/detail/CVE-2026-88058
Code Behaviors & Features
Detect and mitigate CVE-2026-88058 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →