Angular: SSR XSS

Published September 10, 2026 CVE-2026-88060

Angular server-side rendering can turn certain untrusted text into active webpage code. An attacker could run JavaScript in visitors' browsers.

Severity
HighCVSS 4.0 · 8.6
Fix
Update availableFix recorded today
Affected versions
19.2.25 or older; 20.0.0 or newer, but before 20.3.30; 21.0.0 or newer, but before 21.2.22+1 more
Weakness
CWE-79Cross-site Scripting (XSS)
Exploit likelihood
0.70% in 30 daysEPSS, higher than 51% of known flaws
Affects
Angular

How it works

  • The issue requires an Angular application to render untrusted input inside template content nested in certain fallback containers.
  • During server-side rendering, Angular fails to escape matching closing tags across template boundaries.
  • A browser can then end the container early and interpret following markup as active webpage elements.
  • This enables arbitrary JavaScript execution.

What to do

Run npm list @angular/platform-server in each application environment. Compare the installed version with the affected ranges in the Angular advisory.

Run this in the application environment you want to check:

npm list @angular/platform-server

Upgrade to @angular/platform-server 22.1.4, 21.2.22, or 20.3.30, matching your Angular release branch. For Angular 19.2.25 or earlier, consult the Angular advisory for documented guidance.

Technical details

CVE-2026-88060 affects SSR HTML serialization in @angular/platform-server. Unescaped closing tags inside template content nested in fallback containers can break out of those containers and enable arbitrary JavaScript execution in the browser.

Severity breakdown

  • Attack vector Network Requires network access to the vulnerable service
  • Attack complexity Low No extra steps to bypass built-in attack protections
  • Required conditions None No particular deployment or execution condition is required
  • Privileges required None Attacker needs no account or login
  • User action Passive Normal use can trigger the issue without a deliberate risky action
  • Vulnerable system: Data exposure High Sensitive data can be exposed with serious impact
  • Vulnerable system: Data changes High Protected data can be changed with serious impact
  • Vulnerable system: Service disruption None No availability impact
  • Other systems: Data exposure None No additional impact beyond the vulnerable system
  • Other systems: Data changes None No additional impact beyond the vulnerable system
  • Other systems: Service disruption None No additional impact beyond the vulnerable system
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Open in FIRST.org calculator

References

View Original Source