{"uuid": "249c8dc6-ebe6-46cd-b040-c8cf9bb955e2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88058", "type": "seen", "source": "https://gist.github.com/alon710/cee061f55396c28ae35d63a44b37bd22", "content": "# CVE-2026-88058: CVE-2026-88058: Cross-Site Scripting via Server-Side Serialization Discrepancy in @angular/platform-server\n\n> **CVSS Score:** 8.6\n> **Published:** 2026-09-28\n> **Full Report:** https://cvereports.com/reports/CVE-2026-88058\n\n## Summary\nA high-severity Cross-Site Scripting (XSS) vulnerability in Angular server-side rendering (SSR) component allows unauthenticated attackers to execute arbitrary client-side JavaScript. The flaw is caused by a parsing discrepancy between the server-side DOM emulator, Domino, and standard client-side browser HTML5 parsers. When serializing ProcessingInstruction nodes inside raw-content fallback elements, Domino fails to escape matching ancestor closing tags, causing the client-side parser to transition out of raw-text mode prematurely and execute subsequent sibling elements as active HTML.\n\n## TL;DR\nAn unauthenticated attacker can achieve arbitrary JavaScript execution in a victim's browser by injecting closing tags into ProcessingInstruction nodes processed during server-side rendering, exploiting an escaping discrepancy in Angular's DOM emulator.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-79\n- **Attack Vector**: Network\n- **CVSS Base Score**: 8.6\n- **EPSS Score**: 0.00875\n- **Impact**: Arbitrary Client-Side Code Execution (XSS)\n- **Exploit Status**: poc\n- **KEV Status**: Not Listed\n- **Target Component**: Domino HTML Serializer inside @angular/platform-server\n\n## Affected Systems\n\n- @angular/platform-server\n- domino\n- **@angular/platform-server**: >= 20.0.0, < 20.3.30 (Fixed in: `20.3.30`)\n- **@angular/platform-server**: >= 21.0.0, < 21.2.22 (Fixed in: `21.2.22`)\n- **@angular/platform-server**: >= 22.0.0, < 22.1.4 (Fixed in: `22.1.4`)\n- **domino**: < 2.1.7 (Fixed in: `2.1.7 (Commit 04f987dc08ff3736b427f50941adf1722458528f)`)\n\n## Mitigation\n\n- Upgrade Angular framework dependencies to patched releases incorporating the upstream Domino fix.\n- Sanitize all inputs processed by createProcessingInstruction or dynamic DOM node insertion functions on the server side.\n- Implement a strong Content Security Policy (CSP) to mitigate client-side script execution impacts.\n\n**Remediation Steps:**\n1. Identify all projects running Server-Side Rendering (SSR) with @angular/platform-server.\n2. Update package.json file to reference Angular version 20.3.30, 21.2.22, or 22.1.4 or higher.\n3. Regenerate package lock files (package-lock.json, pnpm-lock.yaml, or yarn.lock) to ensure the transitive 'domino' dependency resolves to a version containing commit 04f987dc08ff3736b427f50941adf1722458528f.\n4. Audit all uses of inject(DOCUMENT).createProcessingInstruction or Renderer2 DOM manipulation inside raw-content fallback elements like noscript or iframe.\n5. Redeploy the updated application and verify that serialized output properly escapes closing tag patterns.\n\n## References\n\n- [GitHub Security Advisory GHSA-j3r3-mxqp-r2p4](https://github.com/angular/angular/security/advisories/GHSA-j3r3-mxqp-r2p4)\n- [Official CVE Record](https://www.cve.org/CVERecord?id=CVE-2026-88058)\n- [Angular Issue Tracking #70146](https://github.com/angular/angular/issues/70146)\n- [NVD Vulnerability Details](https://nvd.nist.gov/vuln/detail/CVE-2026-88058)\n- [Domino Patch Commit](https://github.com/angular/domino/commit/04f987dc08ff3736b427f50941adf1722458528f)\n- [Angular Integration Commit (v22/Main)](https://github.com/angular/angular/commit/73d8bbd27cb46495426d4132975a1355b47ad915)\n- [Angular Integration Commit (v21/v20)](https://github.com/angular/angular/commit/89b20568dfaee1ec8e0b3bcf1872acdddd2f4fef)\n- [Angular Release v22.1.4](https://github.com/angular/angular/releases/tag/v22.1.4)\n- [Angular Release v21.2.22](https://github.com/angular/angular/releases/tag/v21.2.22)\n- [Angular Release v20.3.30](https://github.com/angular/angular/releases/tag/v20.3.30)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-88058) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-29T07:30:30.000000Z"}