{"id":"EUVD-2026-75681","enisaUuid":"2de36218-5db7-3953-8d4c-7bd5aa68ab1f","description":"Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.30, 21.2.22, and 22.1.4, Angular server-side rendering (SSR) in @angular/platform-server serializes ProcessingInstruction DOM nodes inside fallback raw-content elements without escaping matching ancestor closing tags. ProcessingInstruction data escaped greater-than characters but left less-than characters untouched and did not inspect fallback ancestors, so data such as a matching closing tag prematurely terminates noscript, iframe, noembed, or noframes containers. The vulnerable nodes cannot be authored through standard Angular templates; reachability requires application or library code using inject(DOCUMENT).createProcessingInstruction with attacker-controlled data or Renderer2 DOM insertion inside a fallback container. In HTML5 RAWTEXT parsing, the premature close causes subsequent sibling elements to be interpreted as live HTML and enables arbitrary JavaScript execution in a victim\u0027s browser. This issue is fixed in versions 20.3.30, 21.2.22, and 22.1.4.","datePublished":"Sep 10, 2026, 6:56:03 PM","dateUpdated":"Sep 11, 2026, 3:14:37 PM","baseScore":8.6,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/angular/angular/security/advisories/GHSA-j3r3-mxqp-r2p4\nhttps://github.com/angular/angular/issues/70146\nhttps://github.com/angular/angular/commit/73d8bbd27cb46495426d4132975a1355b47ad915\nhttps://github.com/angular/angular/commit/89b20568dfaee1ec8e0b3bcf1872acdddd2f4fef\nhttps://github.com/angular/angular/commit/ba3bc47b20b3d12f5eb141ec9c651373ae4d15e8\nhttps://github.com/angular/domino/commit/04f987dc08ff3736b427f50941adf1722458528f\nhttps://github.com/angular/angular/releases/tag/v20.3.30\nhttps://github.com/angular/angular/releases/tag/v21.2.22\nhttps://github.com/angular/angular/releases/tag/v22.1.4\n","aliases":"CVE-2026-88058\nGHSA-j3r3-mxqp-r2p4\n","assigner":"GitHub_M","epss":0.28,"enisaIdProduct":[{"id":"1fa64868-32fb-31ed-8776-2f123baac44b","product":{"name":"angular","vendor":{"name":"angular"}},"product_version":"≤ 19.2.25"},{"id":"4cb82577-138a-3aff-b348-333e294ab3b7","product":{"name":"angular","vendor":{"name":"angular"}},"product_version":"21.0.0, \u003c 21.2.22"},{"id":"6986e0ba-7282-3908-bba3-ddfcb27beb8e","product":{"name":"angular","vendor":{"name":"angular"}},"product_version":"22.0.0, \u003c 22.1.4"},{"id":"7675bfd5-41f1-3c7b-98cd-1ef58e39997d","product":{"name":"angular","vendor":{"name":"angular"}},"product_version":"20.0.0, \u003c 20.3.30"}],"enisaIdVendor":[{"id":"1e0a7126-4111-3a8f-80e8-8f4bd2991440","vendor":{"name":"angular"}}],"enisaIdVulnerability":[{"id":"6339c3fc-a740-3cd5-8383-26154fbf7574","vulnerability":{"id":"GHSA-j3r3-mxqp-r2p4","description":"Angular SSR: XSS via Unescaped Processing Instruction (\u003c?...?\u003e) Nodes in Fallback Raw-Content Elements","datePublished":"Sep 28, 2026, 8:39:26 PM","dateUpdated":"Sep 28, 2026, 8:39:26 PM","baseScore":0.0,"references":"https://github.com/angular/angular/security/advisories/GHSA-j3r3-mxqp-r2p4\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-88058\nhttps://github.com/angular/angular/issues/70146\nhttps://github.com/angular/angular/commit/73d8bbd27cb46495426d4132975a1355b47ad915\nhttps://github.com/angular/angular/commit/89b20568dfaee1ec8e0b3bcf1872acdddd2f4fef\nhttps://github.com/angular/angular/commit/ba3bc47b20b3d12f5eb141ec9c651373ae4d15e8\nhttps://github.com/angular/domino/commit/04f987dc08ff3736b427f50941adf1722458528f\nhttps://github.com/angular/angular\nhttps://github.com/angular/angular/releases/tag/v20.3.30\nhttps://github.com/angular/angular/releases/tag/v21.2.22\nhttps://github.com/angular/angular/releases/tag/v22.1.4\n","enisa_id":"EUVD-2026-75681\n","aliases":"CVE-2026-88058\nGHSA-j3r3-mxqp-r2p4\n","epss":0.0,"dataProcessed":"Nov 9, 2026, 3:54:29 PM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"76c4ccba-08a3-3540-bfe0-88917d01e9a1","vulnerability":{"id":"CVE-2026-88058","description":"Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.30, 21.2.22, and 22.1.4, Angular server-side rendering (SSR) in @angular/platform-server serializes ProcessingInstruction DOM nodes inside fallback raw-content elements without escaping matching ancestor closing tags. ProcessingInstruction data escaped greater-than characters but left less-than characters untouched and did not inspect fallback ancestors, so data such as a matching closing tag prematurely terminates noscript, iframe, noembed, or noframes containers. The vulnerable nodes cannot be authored through standard Angular templates; reachability requires application or library code using inject(DOCUMENT).createProcessingInstruction with attacker-controlled data or Renderer2 DOM insertion inside a fallback container. In HTML5 RAWTEXT parsing, the premature close causes subsequent sibling elements to be interpreted as live HTML and enables arbitrary JavaScript execution in a victim\u0027s browser. This issue is fixed in versions 20.3.30, 21.2.22, and 22.1.4.","datePublished":"Sep 10, 2026, 6:56:03 PM","dateUpdated":"Sep 11, 2026, 3:14:37 PM","status":"PUBLISHED","baseScore":8.6,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/angular/angular/security/advisories/GHSA-j3r3-mxqp-r2p4\nhttps://github.com/angular/angular/issues/70146\nhttps://github.com/angular/angular/commit/73d8bbd27cb46495426d4132975a1355b47ad915\nhttps://github.com/angular/angular/commit/89b20568dfaee1ec8e0b3bcf1872acdddd2f4fef\nhttps://github.com/angular/angular/commit/ba3bc47b20b3d12f5eb141ec9c651373ae4d15e8\nhttps://github.com/angular/domino/commit/04f987dc08ff3736b427f50941adf1722458528f\nhttps://github.com/angular/angular/releases/tag/v20.3.30\nhttps://github.com/angular/angular/releases/tag/v21.2.22\nhttps://github.com/angular/angular/releases/tag/v22.1.4\n","enisa_id":"EUVD-2026-75681\n","assigner":"GitHub_M","epss":0.28,"dataProcessed":"Nov 9, 2026, 3:07:10 PM","vulnerabilityProduct":[{"id":"077143cf-0d1f-33d4-adf2-090ba415901c","product":{"name":"angular","vendor":{"name":"angular"}},"product_version":"22.0.0, \u003c 22.1.4"},{"id":"70d224fc-9fff-35ec-bc30-da21bbee7ecf","product":{"name":"angular","vendor":{"name":"angular"}},"product_version":"≤ 19.2.25"},{"id":"9ff43e4b-cc54-3228-a18b-38233aea4b05","product":{"name":"angular","vendor":{"name":"angular"}},"product_version":"20.0.0, \u003c 20.3.30"},{"id":"f99d0b77-b709-3549-98c0-68c9c4b13d96","product":{"name":"angular","vendor":{"name":"angular"}},"product_version":"21.0.0, \u003c 21.2.22"}],"vulnerabilityVendor":[{"id":"a2561205-1cc0-39bc-820f-ed6412c4e4ce","vendor":{"name":"angular"}}]}}],"enisaIdAdvisory":[]}