---
id: CVE-2026-88058
title: >-
  Angular is a development platform for building mobile and desktop web
  applications using TypeScript/JavaScript and other languages
summary: >-
  Angular is a development platform for building mobile and desktop web
  applications using TypeScript/JavaScript and other languages. Prior to
  20.3.30, 21.2.22, and 22.1.4, Angular server-side rendering (SSR) in
  @angular/platform-server se…
severity: high
cvss: 8.6
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N'
cwe:
  - CWE-79
  - CWE-116
vendor: angular
product: angular
affected:
  - angular <= 19.2.25
  - 'angular >= 20.0.0, < 20.3.30'
  - 'angular >= 21.0.0, < 21.2.22'
  - 'angular >= 22.0.0, < 22.1.4'
published: '2026-09-10'
updated: '2026-09-11'
sourceUpdated: '2026-09-11T16:17:48.513'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-88058'
references:
  - url: >-
      https://github.com/angular/angular/commit/73d8bbd27cb46495426d4132975a1355b47ad915
    label: security-advisories@github.com
  - url: >-
      https://github.com/angular/angular/commit/89b20568dfaee1ec8e0b3bcf1872acdddd2f4fef
    label: security-advisories@github.com
  - url: >-
      https://github.com/angular/angular/commit/ba3bc47b20b3d12f5eb141ec9c651373ae4d15e8
    label: security-advisories@github.com
  - url: 'https://github.com/angular/angular/issues/70146'
    label: security-advisories@github.com
  - url: 'https://github.com/angular/angular/releases/tag/v20.3.30'
    label: security-advisories@github.com
  - url: 'https://github.com/angular/angular/releases/tag/v21.2.22'
    label: security-advisories@github.com
  - url: 'https://github.com/angular/angular/releases/tag/v22.1.4'
    label: security-advisories@github.com
  - url: 'https://github.com/angular/angular/security/advisories/GHSA-j3r3-mxqp-r2p4'
    label: security-advisories@github.com
  - url: >-
      https://github.com/angular/domino/commit/04f987dc08ff3736b427f50941adf1722458528f
    label: security-advisories@github.com
  - url: 'https://github.com/angular/angular/issues/70146'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
  - url: 'https://github.com/angular/angular/security/advisories/GHSA-j3r3-mxqp-r2p4'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
  - cve.org
  - exploit-available
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-09-11T15:14:28.505071Z'
cvssSource: cna
ingestedAt: '2026-09-12T20:04:42.956Z'
epss: 0.00875
epssPercentile: 0.57259
---

## Overview

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.30, 21.2.22, and 22.1.4, Angular server-side rendering (SSR) in @angular/platform-server serializes ProcessingInstruction DOM nodes inside fallback raw-content elements without escaping matching ancestor closing tags. ProcessingInstruction data escaped greater-than characters but left less-than characters untouched and did not inspect fallback ancestors, so data such as a matching closing tag prematurely terminates noscript, iframe, noembed, or noframes containers. The vulnerable nodes cannot be authored through standard Angular templates; reachability requires application or library code using inject(DOCUMENT).createProcessingInstruction with attacker-controlled data or Renderer2 DOM insertion inside a fallback container. In HTML5 RAWTEXT parsing, the premature close causes subsequent sibling elements to be interpreted as live HTML and enables arbitrary JavaScript execution in a victim's browser. This issue is fixed in versions 20.3.30, 21.2.22, and 22.1.4.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.