high advisory September 11, 2026

Cross-Site Scripting in Angular Platform Server SSR

An XSS vulnerability in Angular's server-side rendering serializer fails to escape closing tags within <template> content nested inside fallback raw-content elements, allowing arbitrary script execution.

What's new

1. added coverage for Angular platform-server (22.0.0 <= version < 22.1.4) +3 products Sep 11, 00:55 via ghsa

A high-severity Cross-Site Scripting (XSS) vulnerability, identified as CVE-2026-88060, affects the @angular/platform-server package used for server-side rendering (SSR). The flaw occurs because the HTML serializer fails to correctly identify and escape closing tags when processing <template> content that resides within fallback raw-content elements, such as <noscript>, <iframe>, <noembed>, or <noframes>.

In HTML5, these elements place the browser in RAWTEXT mode, where internal content is parsed as literal text until a matching closing tag is encountered. Because Angular's serializer treats the contents of a <template> as a separate DocumentFragment with a null parent, the traversal logic fails to detect the outer fallback raw-content container. Consequently, malicious input containing closing tags is rendered unescaped in the SSR output, leading to a container breakout and subsequent execution of injected markup when the page is parsed by a victim's browser. This bypasses Angular's built-in protections for standard text interpolation.

Impact

Successful exploitation allows for the execution of arbitrary JavaScript within the context of the user's session, potentially leading to session hijacking, data exfiltration, or unauthorized actions on behalf of the user. The vulnerability is reachable through both standard text interpolation and imperative DOM construction via Renderer2. Affected versions include @angular/platform-server v19.2.25 and below, 20.0.0 through 20.3.29, 21.0.0 through 21.2.21, and 22.0.0 through 22.1.3. Organizations utilizing Angular SSR with dynamic, user-controllable input rendered within the specified template containers are at risk.

Recommendation

Prioritized remediation involves updating the @angular/platform-server package to the latest patched releases. If immediate patching is not feasible, restrict the use of untrusted user input within <template> elements nested in <noscript>, <iframe>, <noembed>, or <noframes>. Security teams should audit codebases for components that use Renderer2 to dynamically construct DOM structures involving these fallback elements to ensure input is sanitized before rendering.