CVE-2026-88060 is a cross-site scripting (XSS) vulnerability in @angular/platform-server's SSR HTML serialization process. When rendering untrusted user input inside raw-text tags (<xmp>, <style>, <script>), comments, or text nodes within a <template> element nested inside fallback raw-content elements (<noscript>, <iframe>, <noembed>, <noframes>), the serializer fails to escape matching closing tags (e.g., </noscript>). This occurs because the serializer's ancestor traversal stops at the DocumentFragment boundary of the <template> content, missing the enclosing fallback container. Consequently, the closing tags are emitted unescaped, allowing injected markup to break out of the fallback container and execute in the browser. This bypasses Angular's default SSR text interpolation safety guarantees. The vulnerability affects versions >=20.0.0 <20.3.30, >=21.0.0 <21.2.22, >=22.0.0 <22.1.4, and <=19.2.25. A patch is available.

This vulnerability allows attackers to inject malicious HTML and scripts during server-side rendering in Angular applications that render untrusted input inside <template> elements nested within fallback raw-content containers. It breaks Angular's default safety guarantees for text interpolation in SSR, potentially leading to cross-site scripting attacks. The impact is high due to the ability to execute arbitrary scripts in the context of the affected web application. However, no known exploits in the wild have been reported.

A patch is available for this vulnerability and should be applied to affected versions of @angular/platform-server. Until patched, avoid rendering untrusted user input inside <template> elements nested within fallback raw-content elements such as <noscript>, <iframe>, <noembed>, or <noframes> in server-rendered templates. Also, avoid programmatic DOM assembly of <template> elements inside these fallback containers when handling untrusted data.