CVE-2026-88060: Angular Platform Server SSR XSS Vulnerability via Unescaped Template Content
Summary
CVE-2026-88060: An XSS vulnerability exists in @angular/platform-server during server-side rendering (SSR) HTML serialization when traversing ancestor tags across element boundaries. Affects @angular/platform-server across 4 version ranges.
< 19.2.25
>= 20.0.0, < 20.3.30
>= 21.0.0, < 21.2.22
>= 22.0.0, < 22.1.4
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @angular/platform-server package is a core component of the Angular framework, enabling server-side rendering (SSR) of Angular applications. This functionality enhances performance and SEO by allowing pre-rendered HTML to be served to clients. However, the package is susceptible to a critical XSS vulnerability that arises during the HTML serialization process when handling untrusted user input within specific raw-content elements.
Vulnerability Detail
An XSS vulnerability exists in @angular/platform-server during server-side rendering (SSR) HTML serialization when traversing ancestor tags across <template> element boundaries. When untrusted user input is rendered within raw-text tags (<xmp>, <style>, <script>), comments, or text nodes inside a <template> nested within fallback raw-content elements (<noscript>, <iframe>, <noembed>, <noframes>), matching closing tags (e.g., </noscript>) are not escaped. This allows untrusted input to prematurely terminate the fallback container and execute malicious scripts as active DOM elements, leading to potential security breaches.
How To Fix
Latest published version: 22.2.3 as of 22 Oct 2026
npm install @angular/platform-server@22.2.3Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 19.2.2519.2.25npm install @angular/platform-server@19.2.25 -
>= 20.0.0, < 20.3.3020.3.30npm install @angular/platform-server@20.3.30 -
>= 21.0.0, < 21.2.2221.2.22npm install @angular/platform-server@21.2.22 -
>= 22.0.0, < 22.1.422.1.4npm install @angular/platform-server@22.1.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
Avoid rendering untrusted user input inside <template> elements nested within <noscript>, <iframe>, <noembed>, or <noframes> in server-rendered templates. Additionally, refrain from programmatic DOM assembly of <template> elements inside fallback containers when handling untrusted data.
Conclusion
CVE-2026-88060 represents a significant security risk for applications using the @angular/platform-server package. By understanding the nature of the vulnerability and applying the necessary updates or workarounds, developers can protect their applications from potential XSS attacks.
See every vulnerability recorded for @angular/platform-server →
FAQ
CVE-2026-88060 is a critical XSS vulnerability in the @angular/platform-server package that affects server-side rendering of Angular applications.
The vulnerability can lead to XSS attacks, allowing attackers to execute arbitrary scripts in the context of the user's browser, potentially compromising user data and application integrity.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Check your application against this vulnerability using the Vulert playground at Vulert Scanner.
Versions 0 to 22.0.0 of @angular/platform-server are affected. The vulnerability is fixed in versions 22.1.4, 21.2.22, and 20.3.30.
If immediate updates are not possible, implement the suggested workarounds to mitigate the risk until you can apply the patch.
References
Related vulnerabilities
Recent vulnerabilities recorded for @angular/platform-server.
