CVE-2026-88058Medium· 6.1▾ TwilightPoC availableAngular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.30, 21.2.22, and 22.1.4, Angular server-side rendering (SSR) in @angular/platform-server se…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 33.6 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 11.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.5%
0.5% → 0.9%
Last analysed / modified upstream
8.6 → 6.1
high → medium
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.30, 21.2.22, and 22.1.4, Angular server-side rendering (SSR) in @angular/platform-server serializes ProcessingInstruction DOM nodes inside fallback raw-content elements without escaping matching ancestor closing tags. ProcessingInstruction data escaped greater-than characters but left less-than characters untouched and did not inspect fallback ancestors, so data such as a matching closing tag prematurely terminates noscript, iframe, noembed, or noframes containers. The vulnerable nodes cannot be authored through standard Angular templates; reachability requires application or library code using inject(DOCUMENT).createProcessingInstruction with attacker-controlled data or Renderer2 DOM insertion inside a fallback container. In HTML5 RAWTEXT parsing, the premature close causes subsequent sibling elements to be interpreted as live HTML and enables arbitrary JavaScript execution in a victim's browser. This issue is fixed in versions 20.3.30, 21.2.22, and 22.1.4.
angular >= 19.0.0, <= 19.2.25angular >= 20.0.0, < 20.3.30angular >= 21.0.0, < 21.2.22angular >= 22.0.0, < 22.1.4Upgrade past the affected range:
angular 22.1.4Affected packages:
@angular/platform-server >= 22.0.0, < 22.1.4@angular/platform-server >= 21.0.0, < 21.2.22@angular/platform-server >= 20.0.0, < 20.3.30@angular/platform-server <= 19.2.25Patched in:
@angular/platform-server 22.1.4@angular/platform-server 21.2.22@angular/platform-server 20.3.30Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-88060Medium· 6.1Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages
CVE-2026-88056Critical· 9.1Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages
CVE-2026-88057Medium· 6.1Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages
CVE-2026-106444Medium· 4.7Handlebars provides the power necessary to let users build semantic templates
CVE-2026-110725Low· 3.7fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix references
CVE-2026-101897Medium· 5.1Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages