Angular SSR: XSS via Unescaped Processing Instruction (<?...?>) Nodes in Fallback Raw-Content Elements

🗓️ 28 Sep 2026 20:39:26Reported by GitHub Advisory DatabaseType

XSS in @angular/platform-server via unescaped tags in nested ProcessingInstruction nodes.

Reporter	Title	Published	Views	Family All 734
Circl	CVE-2026-88058	27 Aug 202605:45	–	circl
CVE	CVE-2026-88058	10 Sep 202618:56	–	cve
Cvelist	CVE-2026-88058 Angular: SSR XSS via Unescaped Processing Instruction (<?...?>) Nodes in Fallback Raw-Content Elements	10 Sep 202618:56	–	cvelist
Debian CVE	CVE-2026-88058	10 Sep 202618:56	–	debiancve
EUVD	EUVD-2026-75681	28 Sep 202620:39	–	euvd
Mend	CVE-2026-88058	10 Sep 202618:56	–	mend
NVD	CVE-2026-88058	10 Sep 202619:17	–	nvd
osv_clsa	CLSA-2026-1790416421 TuxCare security update for @angular (3 CVEs)	26 Sep 202609:53	–	osv_clsa
osv_clsa	CLSA-2026-1790430327 TuxCare security update for @angular (3 CVEs)	26 Sep 202613:45	–	osv_clsa
osv_clsa	CLSA-2026-1790430437 TuxCare security update for @angular (3 CVEs)	26 Sep 202613:47	–	osv_clsa

Vulners

Node

angular platform-serverRange20.0.0–20.3.30npm

angular platform-serverRange21.0.0–21.2.22npm

angular platform-serverRange22.0.0–22.1.4npm

Source	Link
github	www.github.com/angular/angular/security/advisories/GHSA-j3r3-mxqp-r2p4
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-88058
github	www.github.com/angular/angular/issues/70146
github	www.github.com/angular/angular/commit/73d8bbd27cb46495426d4132975a1355b47ad915
github	www.github.com/angular/angular/commit/89b20568dfaee1ec8e0b3bcf1872acdddd2f4fef
github	www.github.com/angular/angular/commit/ba3bc47b20b3d12f5eb141ec9c651373ae4d15e8
github	www.github.com/angular/domino/commit/04f987dc08ff3736b427f50941adf1722458528f
github	www.github.com/angular/angular/releases/tag/v20.3.30
github	www.github.com/angular/angular/releases/tag/v21.2.22
github	www.github.com/angular/angular/releases/tag/v22.1.4

28 Sep 2026 20:40Current

6.6Medium risk

Vulners AI Score6.6

CVSS 3.16.1

CVSS 48.6

EPSS0.00281

SSVC