CVE-2026-88060 Angular: SSR XSS via Unescaped <template> Content Across DocumentFragment Boundaries in Fallback Raw-Content Elements
Angular SSR fails to escape template content in fallback raw-content elements, allowing attackers to inject arbitrary JavaScript via unescaped closing tags.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-88060?
CVE-2026-88060 is a high-severity cross-site scripting vulnerability in angular, published on 10 Sep 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.30, 21.2.22, and 22.1.4, Angular server-side rendering (SSR) in @angular/platform-server serializes untrusted input inside template content nested in fallback raw-content elements such as noscript, iframe, noembed, and noframes. The Domino serializer's fallbackRawContentTags traversal stopped at the DocumentFragment used by template.content, so matching closing tags in xmp, style, script, comments, or text nodes were not escaped. Standard interpolation with comments or text nodes is reachable without relaxed schemas; literal xmp or style requires CUSTOM_ELEMENTS_SCHEMA or NO_ERRORS_SCHEMA, while Renderer2 imperative DOM construction is unconditionally affected. When HTML5 RAWTEXT browser parsing encounters the unescaped closing tag, it exits the fallback container and interprets trailing markup as active DOM elements, enabling arbitrary JavaScript execution. This issue is fixed in versions 20.3.30, 21.2.22, and 22.1.4.
Which versions are affected by CVE-2026-88060?
8 open source packages ship an affected version, including @angular/platform-server. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
@angular/platform-server npm | All versions to 19.2.25 | None |
@angular/platform-server npm | All versions to 19.2.25 | None |
@angular/platform-server npm | From 20.0.0 | 20.3.30 |
@angular/platform-server npm | From 20.0.0 | 20.3.30 |
@angular/platform-server npm | From 21.0.0 | 21.2.22 |
@angular/platform-server npm | From 21.0.0 | 21.2.22 |
2 more packages
@angular/platform-server npm | From 22.0.0 | 22.1.4 |
@angular/platform-server npm | From 22.0.0 | 22.1.4 |
Products include Angular Angular.
How do I fix CVE-2026-88060?
Upgrade @angular/platform-server to a fixed version for your release line: 20.3.30, 21.2.22 or 22.1.4.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-88060 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-88060 exists.
Other vulnerabilities in angular
- CVE-2026-68945 Angular: Cache-Key Ambiguity in HttpTransferCache Leading to Cross-Request Response Reuse and State Poisoning
- CVE-2026-46417 Angular: SSRF via Hostname Hijacking in @angular/platform-server
- CVE-2026-50168 Angular: URL Parser Differential in @angular/platform-server leading to SSRF Allowlist Bypass
- CVE-2026-54266 Angular: Weak 32-Bit Cache Key Hashing in `HttpTransferCache` Leading to Cross-Request Data Leakage and State Poisoning
- CVE-2026-41423 Angular: SSRF via protocol-relative and backslash URLs in Angular Platform-Server
Sources
Also known as DEBIAN-CVE-2026-88060, GHSA-v3p8-whq6-r5jg, UBUNTU-CVE-2026-88060.