XSS in Angular
CVE-2026-88060
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.30, 21.2.22, and 22.1.4, Angular server-side rendering (SSR) in @angular/platform-server serializes untrusted input inside template content nested in fallback raw-content elements such as noscript, iframe, noembed, and noframes. The Domino serializer's fallbackRawContentTags traversal stopped at the DocumentFragment used by template.content, so matching closing tags in xmp, style, script, comments, or text nodes were not escaped. Standard interpolation with comments or text nodes is reachable without relaxed schemas; literal xmp or style requires CUSTOM_ELEMENTS_SCHEMA or NO_ERRORS_SCHEMA, while Renderer2 imperative DOM construction is unconditionally affected. When HTML5 RAWTEXT browser parsing encounters the unescaped closing tag, it exits the fallback container and interprets trailing markup as active DOM elements, enabling arbitrary JavaScript execution. This issue is fixed in versions 20.3.30, 21.2.22, and 22.1.4.
Vulnerability class: XSS (Cross-Site Scripting)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 6.1 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N.
EPSS exploit prediction
EPSS: 0.004 (29.8th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 30th percentile — 29.8% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.008 · newest: 0.004 · change: -0.004
Affected products
- Angular — versions <= 19.2.25, >= 20.0.0, < 20.3.30, >= 21.0.0, < 21.2.22
Weakness classification (CWE)
References
- github.com/angular/angular/commit/73d8bbd27cb46495426d4132975a1355b47ad915 (Patch)
- github.com/angular/angular/commit/89b20568dfaee1ec8e0b3bcf1872acdddd2f4fef (Patch)
- github.com/angular/angular/commit/ba3bc47b20b3d12f5eb141ec9c651373ae4d15e8 (Patch)
- github.com/angular/angular/releases/tag/v20.3.30 (Release Notes)
- github.com/angular/angular/releases/tag/v21.2.22 (Release Notes)
- github.com/angular/angular/releases/tag/v22.1.4 (Release Notes)
- github.com/angular/angular/security/advisories/GHSA-v3p8-whq6-r5jg (Exploit, Vendor Advisory)
- github.com/angular/domino/commit/04f987dc08ff3736b427f50941adf1722458528f (Patch)
Frequently asked questions
- What is CVE-2026-88060?
- CVE-2026-88060 is a medium-severity vulnerability in Angular, classified under Cross-site Scripting. CVSS score: 6.1/10. Published 2026-09-10.
- How severe is CVE-2026-88060?
- Medium severity. CVSS v3 base score is 6.1 out of 10.