Vulnerability-Lookup

CVE-2026-88060 (GCVE-0-2026-88060)

Vulnerability from cvelistv5 – Published: 2026-09-10 19:04 – Updated: 2026-09-10 19:20

Title

Angular: SSR XSS via Unescaped <template> Content Across DocumentFragment Boundaries in Fallback Raw-Content Elements

Summary

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.30, 21.2.22, and 22.1.4, Angular server-side rendering (SSR) in @angular/platform-server serializes untrusted input inside template content nested in fallback raw-content elements such as noscript, iframe, noembed, and noframes. The Domino serializer's fallbackRawContentTags traversal stopped at the DocumentFragment used by template.content, so matching closing tags in xmp, style, script, comments, or text nodes were not escaped. Standard interpolation with comments or text nodes is reachable without relaxed schemas; literal xmp or style requires CUSTOM_ELEMENTS_SCHEMA or NO_ERRORS_SCHEMA, while Renderer2 imperative DOM construction is unconditionally affected. When HTML5 RAWTEXT browser parsing encounters the unescaped closing tag, it exits the fallback container and interprets trailing markup as active DOM elements, enabling arbitrary JavaScript execution. This issue is fixed in versions 20.3.30, 21.2.22, and 22.1.4.

Severity

8.6 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-10 19:19 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-116 - Improper Encoding or Escaping of Output

Assigner

GitHub_M mitre root

References

8 references

URL	Tags
https://github.com/angular/angular/security/advis…	x_refsource_CONFIRM
https://github.com/angular/angular/commit/73d8bbd…	x_refsource_MISC
https://github.com/angular/angular/commit/89b2056…	x_refsource_MISC
https://github.com/angular/angular/commit/ba3bc47…	x_refsource_MISC
https://github.com/angular/domino/commit/04f987dc…	x_refsource_MISC
https://github.com/angular/angular/releases/tag/v…	x_refsource_MISC
https://github.com/angular/angular/releases/tag/v…	x_refsource_MISC
https://github.com/angular/angular/releases/tag/v22.1.4	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
angular	angular	Affected: <= 19.2.25 Affected: >= 20.0.0, < 20.3.30 Affected: >= 21.0.0, < 21.2.22 Affected: >= 22.0.0, < 22.1.4	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-88060",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-10T19:19:47.937061Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-10T19:20:56.297Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/angular/angular/security/advisories/GHSA-v3p8-whq6-r5jg"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "angular",
          "vendor": "angular",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c= 19.2.25"
            },
            {
              "status": "affected",
              "version": "\u003e= 20.0.0, \u003c 20.3.30"
            },
            {
              "status": "affected",
              "version": "\u003e= 21.0.0, \u003c 21.2.22"
            },
            {
              "status": "affected",
              "version": "\u003e= 22.0.0, \u003c 22.1.4"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.30, 21.2.22, and 22.1.4, Angular server-side rendering (SSR) in @angular/platform-server serializes untrusted input inside template content nested in fallback raw-content elements such as noscript, iframe, noembed, and noframes. The Domino serializer\u0027s fallbackRawContentTags traversal stopped at the DocumentFragment used by template.content, so matching closing tags in xmp, style, script, comments, or text nodes were not escaped. Standard interpolation with comments or text nodes is reachable without relaxed schemas; literal xmp or style requires CUSTOM_ELEMENTS_SCHEMA or NO_ERRORS_SCHEMA, while Renderer2 imperative DOM construction is unconditionally affected. When HTML5 RAWTEXT browser parsing encounters the unescaped closing tag, it exits the fallback container and interprets trailing markup as active DOM elements, enabling arbitrary JavaScript execution. This issue is fixed in versions 20.3.30, 21.2.22, and 22.1.4."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-116",
              "description": "CWE-116: Improper Encoding or Escaping of Output",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-10T19:04:17.420Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/angular/angular/security/advisories/GHSA-v3p8-whq6-r5jg",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/angular/angular/security/advisories/GHSA-v3p8-whq6-r5jg"
        },
        {
          "name": "https://github.com/angular/angular/commit/73d8bbd27cb46495426d4132975a1355b47ad915",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/angular/angular/commit/73d8bbd27cb46495426d4132975a1355b47ad915"
        },
        {
          "name": "https://github.com/angular/angular/commit/89b20568dfaee1ec8e0b3bcf1872acdddd2f4fef",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/angular/angular/commit/89b20568dfaee1ec8e0b3bcf1872acdddd2f4fef"
        },
        {
          "name": "https://github.com/angular/angular/commit/ba3bc47b20b3d12f5eb141ec9c651373ae4d15e8",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/angular/angular/commit/ba3bc47b20b3d12f5eb141ec9c651373ae4d15e8"
        },
        {
          "name": "https://github.com/angular/domino/commit/04f987dc08ff3736b427f50941adf1722458528f",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/angular/domino/commit/04f987dc08ff3736b427f50941adf1722458528f"
        },
        {
          "name": "https://github.com/angular/angular/releases/tag/v20.3.30",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/angular/angular/releases/tag/v20.3.30"
        },
        {
          "name": "https://github.com/angular/angular/releases/tag/v21.2.22",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/angular/angular/releases/tag/v21.2.22"
        },
        {
          "name": "https://github.com/angular/angular/releases/tag/v22.1.4",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/angular/angular/releases/tag/v22.1.4"
        }
      ],
      "source": {
        "advisory": "GHSA-v3p8-whq6-r5jg",
        "discovery": "UNKNOWN"
      },
      "title": "Angular: SSR XSS via Unescaped \u003ctemplate\u003e Content Across DocumentFragment Boundaries in Fallback Raw-Content Elements"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-88060",
    "datePublished": "2026-09-10T19:04:17.420Z",
    "dateReserved": "2026-09-09T21:22:45.434Z",
    "dateUpdated": "2026-09-10T19:20:56.297Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-88060",
      "date": "2026-09-11",
      "epss": "0.00696",
      "percentile": "0.5098"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-88060\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-09-10T19:17:42.107\",\"lastModified\":\"2026-09-10T20:17:31.417\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.30, 21.2.22, and 22.1.4, Angular server-side rendering (SSR) in @angular/platform-server serializes untrusted input inside template content nested in fallback raw-content elements such as noscript, iframe, noembed, and noframes. The Domino serializer\u0027s fallbackRawContentTags traversal stopped at the DocumentFragment used by template.content, so matching closing tags in xmp, style, script, comments, or text nodes were not escaped. Standard interpolation with comments or text nodes is reachable without relaxed schemas; literal xmp or style requires CUSTOM_ELEMENTS_SCHEMA or NO_ERRORS_SCHEMA, while Renderer2 imperative DOM construction is unconditionally affected. When HTML5 RAWTEXT browser parsing encounters the unescaped closing tag, it exits the fallback container and interprets trailing markup as active DOM elements, enabling arbitrary JavaScript execution. This issue is fixed in versions 20.3.30, 21.2.22, and 22.1.4.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"angular\",\"product\":\"angular\",\"versions\":[{\"version\":\"\u003c= 19.2.25\",\"status\":\"affected\"},{\"version\":\"\u003e= 20.0.0, \u003c 20.3.30\",\"status\":\"affected\"},{\"version\":\"\u003e= 21.0.0, \u003c 21.2.22\",\"status\":\"affected\"},{\"version\":\"\u003e= 22.0.0, \u003c 22.1.4\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\",\"baseScore\":8.6,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"NONE\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"PASSIVE\",\"vulnConfidentialityImpact\":\"HIGH\",\"vulnIntegrityImpact\":\"HIGH\",\"vulnAvailabilityImpact\":\"NONE\",\"subConfidentialityImpact\":\"NONE\",\"subIntegrityImpact\":\"NONE\",\"subAvailabilityImpact\":\"NONE\",\"exploitMaturity\":\"NOT_DEFINED\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\"}}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-09-10T19:19:47.937061Z\",\"id\":\"CVE-2026-88060\",\"options\":[{\"exploitation\":\"poc\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-79\"},{\"lang\":\"en\",\"value\":\"CWE-116\"}]}],\"references\":[{\"url\":\"https://github.com/angular/angular/commit/73d8bbd27cb46495426d4132975a1355b47ad915\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/angular/angular/commit/89b20568dfaee1ec8e0b3bcf1872acdddd2f4fef\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/angular/angular/commit/ba3bc47b20b3d12f5eb141ec9c651373ae4d15e8\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/angular/angular/releases/tag/v20.3.30\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/angular/angular/releases/tag/v21.2.22\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/angular/angular/releases/tag/v22.1.4\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/angular/angular/security/advisories/GHSA-v3p8-whq6-r5jg\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/angular/domino/commit/04f987dc08ff3736b427f50941adf1722458528f\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/angular/angular/security/advisories/GHSA-v3p8-whq6-r5jg\",\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\"}]}}",
    "vulnrichment": {
      "containers": "{\"cna\": {\"title\": \"Angular: SSR XSS via Unescaped \u003ctemplate\u003e Content Across DocumentFragment Boundaries in Fallback Raw-Content Elements\", \"problemTypes\": [{\"descriptions\": [{\"cweId\": \"CWE-79\", \"lang\": \"en\", \"description\": \"CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)\", \"type\": \"CWE\"}]}, {\"descriptions\": [{\"cweId\": \"CWE-116\", \"lang\": \"en\", \"description\": \"CWE-116: Improper Encoding or Escaping of Output\", \"type\": \"CWE\"}]}], \"metrics\": [{\"cvssV4_0\": {\"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"NONE\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"PASSIVE\", \"vulnConfidentialityImpact\": \"HIGH\", \"vulnIntegrityImpact\": \"HIGH\", \"vulnAvailabilityImpact\": \"NONE\", \"subConfidentialityImpact\": \"NONE\", \"subIntegrityImpact\": \"NONE\", \"subAvailabilityImpact\": \"NONE\", \"baseScore\": 8.6, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N\", \"version\": \"4.0\"}}], \"references\": [{\"name\": \"https://github.com/angular/angular/security/advisories/GHSA-v3p8-whq6-r5jg\", \"tags\": [\"x_refsource_CONFIRM\"], \"url\": \"https://github.com/angular/angular/security/advisories/GHSA-v3p8-whq6-r5jg\"}, {\"name\": \"https://github.com/angular/angular/commit/73d8bbd27cb46495426d4132975a1355b47ad915\", \"tags\": [\"x_refsource_MISC\"], \"url\": \"https://github.com/angular/angular/commit/73d8bbd27cb46495426d4132975a1355b47ad915\"}, {\"name\": \"https://github.com/angular/angular/commit/89b20568dfaee1ec8e0b3bcf1872acdddd2f4fef\", \"tags\": [\"x_refsource_MISC\"], \"url\": \"https://github.com/angular/angular/commit/89b20568dfaee1ec8e0b3bcf1872acdddd2f4fef\"}, {\"name\": \"https://github.com/angular/angular/commit/ba3bc47b20b3d12f5eb141ec9c651373ae4d15e8\", \"tags\": [\"x_refsource_MISC\"], \"url\": \"https://github.com/angular/angular/commit/ba3bc47b20b3d12f5eb141ec9c651373ae4d15e8\"}, {\"name\": \"https://github.com/angular/domino/commit/04f987dc08ff3736b427f50941adf1722458528f\", \"tags\": [\"x_refsource_MISC\"], \"url\": \"https://github.com/angular/domino/commit/04f987dc08ff3736b427f50941adf1722458528f\"}, {\"name\": \"https://github.com/angular/angular/releases/tag/v20.3.30\", \"tags\": [\"x_refsource_MISC\"], \"url\": \"https://github.com/angular/angular/releases/tag/v20.3.30\"}, {\"name\": \"https://github.com/angular/angular/releases/tag/v21.2.22\", \"tags\": [\"x_refsource_MISC\"], \"url\": \"https://github.com/angular/angular/releases/tag/v21.2.22\"}, {\"name\": \"https://github.com/angular/angular/releases/tag/v22.1.4\", \"tags\": [\"x_refsource_MISC\"], \"url\": \"https://github.com/angular/angular/releases/tag/v22.1.4\"}], \"affected\": [{\"vendor\": \"angular\", \"product\": \"angular\", \"versions\": [{\"version\": \"\u003c= 19.2.25\", \"status\": \"affected\"}, {\"version\": \"\u003e= 20.0.0, \u003c 20.3.30\", \"status\": \"affected\"}, {\"version\": \"\u003e= 21.0.0, \u003c 21.2.22\", \"status\": \"affected\"}, {\"version\": \"\u003e= 22.0.0, \u003c 22.1.4\", \"status\": \"affected\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-09-10T19:04:17.420Z\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.30, 21.2.22, and 22.1.4, Angular server-side rendering (SSR) in @angular/platform-server serializes untrusted input inside template content nested in fallback raw-content elements such as noscript, iframe, noembed, and noframes. The Domino serializer\u0027s fallbackRawContentTags traversal stopped at the DocumentFragment used by template.content, so matching closing tags in xmp, style, script, comments, or text nodes were not escaped. Standard interpolation with comments or text nodes is reachable without relaxed schemas; literal xmp or style requires CUSTOM_ELEMENTS_SCHEMA or NO_ERRORS_SCHEMA, while Renderer2 imperative DOM construction is unconditionally affected. When HTML5 RAWTEXT browser parsing encounters the unescaped closing tag, it exits the fallback container and interprets trailing markup as active DOM elements, enabling arbitrary JavaScript execution. This issue is fixed in versions 20.3.30, 21.2.22, and 22.1.4.\"}], \"source\": {\"advisory\": \"GHSA-v3p8-whq6-r5jg\", \"discovery\": \"UNKNOWN\"}}, \"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-88060\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-09-10T19:19:47.937061Z\"}}}], \"references\": [{\"url\": \"https://github.com/angular/angular/security/advisories/GHSA-v3p8-whq6-r5jg\", \"tags\": [\"exploit\"]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-09-10T19:20:11.145Z\"}}]}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-88060\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"state\": \"PUBLISHED\", \"assignerShortName\": \"GitHub_M\", \"dateReserved\": \"2026-09-09T21:22:45.434Z\", \"datePublished\": \"2026-09-10T19:04:17.420Z\", \"dateUpdated\": \"2026-09-10T19:20:56.297Z\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-88060

Vulnerability from fkie_nvd - Published: 2026-09-10 19:17 - Updated: 2026-09-10 20:17

Severity

8.6 (High) - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/angular/angular/commit/73d8bbd27cb46495426d4132975a1355b47ad915
	security-advisories@github.com	https://github.com/angular/angular/commit/89b20568dfaee1ec8e0b3bcf1872acdddd2f4fef
	security-advisories@github.com	https://github.com/angular/angular/commit/ba3bc47b20b3d12f5eb141ec9c651373ae4d15e8
	security-advisories@github.com	https://github.com/angular/angular/releases/tag/v20.3.30
	security-advisories@github.com	https://github.com/angular/angular/releases/tag/v21.2.22
	security-advisories@github.com	https://github.com/angular/angular/releases/tag/v22.1.4
	security-advisories@github.com	https://github.com/angular/angular/security/advisories/GHSA-v3p8-whq6-r5jg
	security-advisories@github.com	https://github.com/angular/domino/commit/04f987dc08ff3736b427f50941adf1722458528f
	134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/angular/angular/security/advisories/GHSA-v3p8-whq6-r5jg

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "angular",
          "vendor": "angular",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c= 19.2.25"
            },
            {
              "status": "affected",
              "version": "\u003e= 20.0.0, \u003c 20.3.30"
            },
            {
              "status": "affected",
              "version": "\u003e= 21.0.0, \u003c 21.2.22"
            },
            {
              "status": "affected",
              "version": "\u003e= 22.0.0, \u003c 22.1.4"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.30, 21.2.22, and 22.1.4, Angular server-side rendering (SSR) in @angular/platform-server serializes untrusted input inside template content nested in fallback raw-content elements such as noscript, iframe, noembed, and noframes. The Domino serializer\u0027s fallbackRawContentTags traversal stopped at the DocumentFragment used by template.content, so matching closing tags in xmp, style, script, comments, or text nodes were not escaped. Standard interpolation with comments or text nodes is reachable without relaxed schemas; literal xmp or style requires CUSTOM_ELEMENTS_SCHEMA or NO_ERRORS_SCHEMA, while Renderer2 imperative DOM construction is unconditionally affected. When HTML5 RAWTEXT browser parsing encounters the unescaped closing tag, it exits the fallback container and interprets trailing markup as active DOM elements, enabling arbitrary JavaScript execution. This issue is fixed in versions 20.3.30, 21.2.22, and 22.1.4."
    }
  ],
  "id": "CVE-2026-88060",
  "lastModified": "2026-09-10T20:17:31.417",
  "metrics": {
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 8.6,
          "baseSeverity": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "NONE",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "PASSIVE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "NONE",
          "vulnConfidentialityImpact": "HIGH",
          "vulnIntegrityImpact": "HIGH",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-88060",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-09-10T19:19:47.937061Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-09-10T19:17:42.107",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/angular/angular/commit/73d8bbd27cb46495426d4132975a1355b47ad915"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/angular/angular/commit/89b20568dfaee1ec8e0b3bcf1872acdddd2f4fef"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/angular/angular/commit/ba3bc47b20b3d12f5eb141ec9c651373ae4d15e8"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/angular/angular/releases/tag/v20.3.30"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/angular/angular/releases/tag/v21.2.22"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/angular/angular/releases/tag/v22.1.4"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/angular/angular/security/advisories/GHSA-v3p8-whq6-r5jg"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/angular/domino/commit/04f987dc08ff3736b427f50941adf1722458528f"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/angular/angular/security/advisories/GHSA-v3p8-whq6-r5jg"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        },
        {
          "lang": "en",
          "value": "CWE-116"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-V3P8-WHQ6-R5JG

Vulnerability from github – Published: 2026-09-10 20:25 – Updated: 2026-09-10 20:25

Summary

Angular: SSR XSS via Unescaped <template> Content Across DocumentFragment Boundaries in Fallback Raw-Content Elements

Details

Summary

An XSS vulnerability exists in @angular/platform-server during server-side rendering (SSR) HTML serialization when traversing ancestor tags across <template> element boundaries. When an application renders untrusted user input within raw-text tags (<xmp>, <style>, <script>), comments, or text nodes inside a <template> that is nested within a fallback raw-content element (<noscript>, <iframe>, <noembed>, <noframes>), matching closing tags (e.g., </noscript>) are not escaped during HTML serialization. When rendered in a browser, this unescaped closing tag prematurely terminates the fallback container and executes trailing markup as active DOM elements.

Technical Description

In HTML5 parsing, fallback raw-content elements (<noscript>, <iframe>, <noembed>, <noframes>) place the browser's tokenizer into RAWTEXT mode. In this mode, inner content is parsed as literal text until an end tag matching the container tag name (e.g., </noscript>) is encountered.

To prevent XSS breakout vectors during SSR serialization, the DOM serializer inspects a node's ancestors to escape any matching fallback closing tags (`

Severity

8.6 (High)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "@angular/platform-server"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "22.0.0"
            },
            {
              "fixed": "22.1.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "@angular/platform-server"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "21.0.0"
            },
            {
              "fixed": "21.2.22"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "@angular/platform-server"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "20.0.0"
            },
            {
              "fixed": "20.3.30"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "@angular/platform-server"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "19.2.25"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-88060"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79",
      "CWE-116"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-10T20:25:25Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Summary\nAn XSS vulnerability exists in `@angular/platform-server` during server-side rendering (SSR) HTML serialization when traversing ancestor tags across `\u003ctemplate\u003e` element boundaries. When an application renders untrusted user input within raw-text tags (`\u003cxmp\u003e`, `\u003cstyle\u003e`, `\u003cscript\u003e`), comments, or text nodes inside a `\u003ctemplate\u003e` that is nested within a fallback raw-content element (`\u003cnoscript\u003e`, `\u003ciframe\u003e`, `\u003cnoembed\u003e`, `\u003cnoframes\u003e`), matching closing tags (e.g., `\u003c/noscript\u003e`) are not escaped during HTML serialization. When rendered in a browser, this unescaped closing tag prematurely terminates the fallback container and executes trailing markup as active DOM elements.\n\n### Technical Description\nIn HTML5 parsing, fallback raw-content elements (`\u003cnoscript\u003e`, `\u003ciframe\u003e`, `\u003cnoembed\u003e`, `\u003cnoframes\u003e`) place the browser\u0027s tokenizer into `RAWTEXT` mode. In this mode, inner content is parsed as literal text until an end tag matching the container tag name (e.g., `\u003c/noscript\u003e`) is encountered.\n\nTo prevent XSS breakout vectors during SSR serialization, the DOM serializer inspects a node\u0027s ancestors to escape any matching fallback closing tags (`\u003c/tag` -\u003e `\u0026lt;/tag`). However:\n1. Per DOM specifications, the children of a `\u003ctemplate\u003e` element reside in a separate `DocumentFragment` (`template.content`), whose own `parentNode` is `null`.\n2. The serializer\u0027s ancestor traversal previously only inspected element nodes. When traversing upward from a node inside `template.content`, traversal terminated immediately at the `DocumentFragment` boundary.\n3. Because traversal stopped before reaching the outer document tree, enclosing fallback raw-content ancestors (such as `\u003cnoscript\u003e` or `\u003ciframe\u003e`) were not discovered. As a result, closing sequences like `\u003c/noscript\u003e` within `\u003ctemplate\u003e` content were emitted unescaped.\n\n### Impact \u0026 Reachability\n* **Framework Guarantee Bypass**: Angular guarantees that standard text interpolation (`{{ userInput }}` bound as element text content) is safe by default without manual sanitization. This vulnerability bypasses that guarantee during SSR HTML serialization when untrusted input is interpolated inside template content within fallback containers.\n* **Template Authoring**: Writing literal `\u003cxmp\u003e` or `\u003cstyle\u003e` directly inside a component\u0027s `\u003ctemplate\u003e` markup requires relaxed template schema checks (`CUSTOM_ELEMENTS_SCHEMA` or `NO_ERRORS_SCHEMA`). However, standard HTML comments and text nodes inside `\u003ctemplate\u003e` within `\u003cnoscript\u003e` are reachable without relaxed schemas.\n* **Imperative DOM Construction**: Components or directives that construct DOM structures imperatively via `Renderer2` bypass template compiler schema checks entirely and are unconditionally affected.\n\n### Proof of Concept (Minimal Reproduction)\n```ts\nimport { Component } from \u0027@angular/core\u0027;\n\n@Component({\n  selector: \u0027app-root\u0027,\n  standalone: true,\n  template: `\n    \u003cnoscript\u003e\n      \u003ctemplate\u003e\n        \u003cxmp\u003e{{ payload }}\u003c/xmp\u003e\n      \u003c/template\u003e\n    \u003c/noscript\u003e\n  `\n})\nexport class AppComponent {\n  // Attacker-controlled input bound via standard text interpolation\n  payload = \u0027\u003c/noscript\u003e\u003cimg src=x onerror=alert(\"SSR_TEMPLATE_XSS\")\u003e\u0027;\n}\n```\n**Vulnerable SSR Output**:\n```html\n\u003cnoscript\u003e\u003ctemplate\u003e\u003cxmp\u003e\u003c/noscript\u003e\u003cimg src=x onerror=alert(\"SSR_TEMPLATE_XSS\")\u003e\u003c/xmp\u003e\u003c/template\u003e\u003c/noscript\u003e\n```\n\n### Workarounds\n* Avoid rendering untrusted user input inside `\u003ctemplate\u003e` elements nested within `\u003cnoscript\u003e`, `\u003ciframe\u003e`, `\u003cnoembed\u003e`, or `\u003cnoframes\u003e` in server-rendered templates.\n* Avoid programmatic DOM assembly of `\u003ctemplate\u003e` elements inside fallback containers when handling untrusted data.",
  "id": "GHSA-v3p8-whq6-r5jg",
  "modified": "2026-09-10T20:25:25Z",
  "published": "2026-09-10T20:25:25Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/angular/angular/security/advisories/GHSA-v3p8-whq6-r5jg"
    },
    {
      "type": "WEB",
      "url": "https://github.com/angular/angular/commit/73d8bbd27cb46495426d4132975a1355b47ad915"
    },
    {
      "type": "WEB",
      "url": "https://github.com/angular/angular/commit/89b20568dfaee1ec8e0b3bcf1872acdddd2f4fef"
    },
    {
      "type": "WEB",
      "url": "https://github.com/angular/angular/commit/ba3bc47b20b3d12f5eb141ec9c651373ae4d15e8"
    },
    {
      "type": "WEB",
      "url": "https://github.com/angular/domino/commit/04f987dc08ff3736b427f50941adf1722458528f"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/angular/angular"
    },
    {
      "type": "WEB",
      "url": "https://github.com/angular/angular/releases/tag/v20.3.30"
    },
    {
      "type": "WEB",
      "url": "https://github.com/angular/angular/releases/tag/v21.2.22"
    },
    {
      "type": "WEB",
      "url": "https://github.com/angular/angular/releases/tag/v22.1.4"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Angular: SSR XSS via Unescaped \u003ctemplate\u003e Content Across DocumentFragment Boundaries in Fallback Raw-Content Elements"
}

ubuntu-cve-2026-88060

Vulnerability from osv_ubuntu

Published

2026-09-11 00:00

Modified

2026-09-11 00:00

Summary

Details

(Angular is a development platform for building mobile and desktop web ...)

Severity

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2026-88060	REPORT
	https://www.cve.org/CVERecord?id=CVE-2026-88060	REPORT
	https://github.com/angular/angular/security/advis…	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libjs-angularjs",
            "binary_version": "1.2.28-1ubuntu2+esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:16.04:LTS",
        "name": "angular.js",
        "purl": "pkg:deb/ubuntu/angular.js@1.2.28-1ubuntu2+esm1?arch=source\u0026distro=esm-infra/xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.2.28-1ubuntu2",
        "1.2.28-1ubuntu2+esm1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libjs-angularjs",
            "binary_version": "1.5.10-1ubuntu0.1~esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:18.04:LTS",
        "name": "angular.js",
        "purl": "pkg:deb/ubuntu/angular.js@1.5.10-1ubuntu0.1~esm1?arch=source\u0026distro=esm-infra/bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.5.10-1",
        "1.5.10-1ubuntu0.1~esm1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libjs-angularjs",
            "binary_version": "1.7.9-1ubuntu0.1~esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:20.04:LTS",
        "name": "angular.js",
        "purl": "pkg:deb/ubuntu/angular.js@1.7.9-1ubuntu0.1~esm1?arch=source\u0026distro=esm-apps/focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.5.10-1",
        "1.7.9-1",
        "1.7.9-1ubuntu0.1~esm1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libjs-angularjs",
            "binary_version": "1.8.2-2ubuntu0.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:22.04:LTS",
        "name": "angular.js",
        "purl": "pkg:deb/ubuntu/angular.js@1.8.2-2ubuntu0.1?arch=source\u0026distro=jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.8.2-2",
        "1.8.2-2ubuntu0.1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libjs-angularjs",
            "binary_version": "1.8.3-1ubuntu0.24.04.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:24.04:LTS",
        "name": "angular.js",
        "purl": "pkg:deb/ubuntu/angular.js@1.8.3-1ubuntu0.24.04.1?arch=source\u0026distro=noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.8.3-1",
        "1.8.3-1ubuntu0.24.04.1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libjs-angularjs",
            "binary_version": "1.8.3-3"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:26.04:LTS",
        "name": "angular.js",
        "purl": "pkg:deb/ubuntu/angular.js@1.8.3-3?arch=source\u0026distro=resolute"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.8.3-3"
      ]
    }
  ],
  "aliases": [],
  "details": "(Angular is a development platform for building mobile and desktop web ...)",
  "id": "UBUNTU-CVE-2026-88060",
  "modified": "2026-09-11T00:00:00Z",
  "published": "2026-09-11T00:00:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-88060"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-88060"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/angular/angular/security/advisories/GHSA-v3p8-whq6-r5jg"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2026-88060"
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

CVE-2026-88060 (GCVE-0-2026-88060)

FKIE_CVE-2026-88060

GHSA-V3P8-WHQ6-R5JG

Summary

Technical Description

ubuntu-cve-2026-88060

Vulnerability from osv_ubuntu

Tags

Sightings

Nomenclature