Platform server: Angular SSR: XSS via Unescaped Processing Instruction (<?...?>) Nodes in Fallback Raw-Content Elements (CVE-2026-88058)
An XSS vulnerability exists in @angular/platform-server during server-side rendering of ProcessingInstruction DOM nodes nested inside fallback raw-content elements like <noscript>. The vulnerability arises because processing instruction data escapes > but not < or closing tags of ancestor fallback elements, allowing an attacker to prematurely close these elements and inject live HTML. Exploitation requires application or library code to programmatically create processing instruction nodes with untrusted data inside fallback elements during SSR. This can lead to arbitrary JavaScript execution in users' browsers.
AI Analysis
Technical Summary
The vulnerability in @angular/platform-server (CVE-2026-88058) involves improper escaping of ProcessingInstruction nodes during server-side rendering HTML serialization when nested inside fallback raw-content elements such as <noscript>, <iframe>, <noembed>, and <noframes>. While the > character is escaped to >, the serialization does not escape < or closing tags of ancestor fallback elements. This allows an attacker controlling the processing instruction data to inject sequences like </noscript> unescaped, prematurely closing the fallback element and enabling subsequent sibling elements to execute as live HTML. The vulnerability requires code to create processing instruction nodes with untrusted input inside fallback raw-content containers, which is not possible via standard Angular template syntax but can occur via direct DOM API calls. This leads to cross-site scripting (XSS) on the client side.
Potential Impact
If an attacker can supply untrusted input to processing instruction nodes inside fallback raw-content elements during server-side rendering, they can break out of these elements and execute arbitrary JavaScript in the victim's browser. This results in a high-severity cross-site scripting vulnerability. However, exploitation requires specific conditions: the application or libraries must programmatically create processing instruction nodes with attacker-controlled data inside fallback raw-content containers during SSR. Standard Angular templates do not allow authoring such nodes, limiting the attack surface.
Mitigation Recommendations
A patch is available for this vulnerability. Users should update to fixed versions of @angular/platform-server. Until patched, avoid passing untrusted user input into document.createProcessingInstruction or Renderer2 DOM insertion methods when inserting nodes inside <noscript>, <iframe>, <noembed>, or <noframes> during server-side rendering. Alternatively, manually sanitize or replace the < character with < in any untrusted data passed to processing instruction nodes on the server to prevent injection of closing tags.
Platform server: Angular SSR: XSS via Unescaped Processing Instruction (<?...?>) Nodes in Fallback Raw-Content Elements (CVE-2026-88058)
Description
An XSS vulnerability exists in @angular/platform-server during server-side rendering of ProcessingInstruction DOM nodes nested inside fallback raw-content elements like <noscript>. The vulnerability arises because processing instruction data escapes > but not < or closing tags of ancestor fallback elements, allowing an attacker to prematurely close these elements and inject live HTML. Exploitation requires application or library code to programmatically create processing instruction nodes with untrusted data inside fallback elements during SSR. This can lead to arbitrary JavaScript execution in users' browsers.
CVSS v4.0
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in @angular/platform-server (CVE-2026-88058) involves improper escaping of ProcessingInstruction nodes during server-side rendering HTML serialization when nested inside fallback raw-content elements such as <noscript>, <iframe>, <noembed>, and <noframes>. While the > character is escaped to >, the serialization does not escape < or closing tags of ancestor fallback elements. This allows an attacker controlling the processing instruction data to inject sequences like </noscript> unescaped, prematurely closing the fallback element and enabling subsequent sibling elements to execute as live HTML. The vulnerability requires code to create processing instruction nodes with untrusted input inside fallback raw-content containers, which is not possible via standard Angular template syntax but can occur via direct DOM API calls. This leads to cross-site scripting (XSS) on the client side.
Potential Impact
If an attacker can supply untrusted input to processing instruction nodes inside fallback raw-content elements during server-side rendering, they can break out of these elements and execute arbitrary JavaScript in the victim's browser. This results in a high-severity cross-site scripting vulnerability. However, exploitation requires specific conditions: the application or libraries must programmatically create processing instruction nodes with attacker-controlled data inside fallback raw-content containers during SSR. Standard Angular templates do not allow authoring such nodes, limiting the attack surface.
Mitigation Recommendations
A patch is available for this vulnerability. Users should update to fixed versions of @angular/platform-server. Until patched, avoid passing untrusted user input into document.createProcessingInstruction or Renderer2 DOM insertion methods when inserting nodes inside <noscript>, <iframe>, <noembed>, or <noframes> during server-side rendering. Alternatively, manually sanitize or replace the < character with < in any untrusted data passed to processing instruction nodes on the server to prevent injection of closing tags.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-j3r3-mxqp-r2p4
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-88058"]
- Ecosystems
- ["npm"]
- Database Specific Severity
- HIGH
- Cvss Version
- 4.0
Threat ID: 6abb4193f7a7c54106cc37fb
Added to database: 09/29/2026, 04:41:55 UTC
Last enriched: 09/29/2026, 04:50:07 UTC
Last updated: 09/29/2026, 18:11:21 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.