Threats tagged 'ghsa-v3p8-whq6-r5jg'

CVE-2026-88060 is a cross-site scripting (XSS) vulnerability in Angular's @angular/platform-server during server-side rendering (SSR). It occurs when untrusted input is serialized inside <template> elements nested within fallback raw-content elements such as <noscript>. The serializer fails to properly escape closing tags inside template content, causing premature termination of fallback containers and potential execution of injected markup in browsers. This bypasses Angular's default text interpolation safety during SSR. A patch is available to address this issue.