Vulnerability · CVE-2026-88058
SSR XSS via Unescaped Processing Instruction ( ) Nodes in Fallback Raw-Content Elements
Published Aug 27, 2026 · catalog updated Sep 10, 2026 · SSR XSS via Unescaped
Last checked Nov 2, 2026. A connected source was read within the last 7 days.
Check if you run it
No confirmed exploitation is on record for CVE-2026-88058. EPSS is 0.28%. Act only if a listed version of SSR XSS via Unescaped is installed.
Gaps on this record
- The stored product name is a package slug. The name on this page is taken from the title (SSR XSS via Unescaped).
- No vendor fix or required action is stored. Compare the linked advisory before you change production.
- Severity
- High—
- Known exploitation
- Not in CISA/VulnCheck KEV
- EPSS
- 0.28%
- Remediation
- Version ranges on file
- Affected products
- npm @angular/platform-server
### Summary An XSS vulnerability exists in during server-side rendering (SSR) HTML serialization of DOM nodes ( , ) when nested inside fallback raw-content elements ( , , , ). While processing instruction data escaped to , it did not check for or escape matching closing tags of ancestor fallback elements (e.g., ). When rendered in a browser with scripting enabled, an unescaped closing tag sequence in a processing instruction prematurely closes the fallback raw-content tag and causes subsequent sibling elements to execute as live HTML. ### Technical Description In HTML5 parsing, fallback raw-content elements ( , , , ) place the browser's HTML tokenizer into mode. In mode, processing instruction tokens ( ) are treated as literal raw text rather than bogus comments, and the parser ignores or . The only token sequence that terminates the container is an end tag matching the container tag name ( , , etc.). During server-side HTML serialization, processing instruction nodes previously only replaced with (preventing bogus comment breakouts in normal HTML data states) but left untouched. Crucially, processing instruction serialization never inspected ancestor fallback raw-content tags. As a result, if a node inside contained in its data payload, it was emitted unescaped as . ### Impact & Reachability * **Reachability**: Processing instruction nodes cannot be authored directly through standard Angular template syntax (which parses into comment nodes in DOM position). Reaching this vulnerability requires application or library code calling or DOM insertion methods with untrusted user input passed to inside a fallback raw-content container. * **Impact**: In applications that programmatically construct processing instruction nodes inside fallback elements during server-side rendering, an attacker controlling the processing instruction data can break out of the container and execute arbitrary JavaScript in victims' browsers. ### Proof of Concept (Minimal Reproduction) **Vulnerab
Are you affected?
Enter the version you run. The result uses only the ranges stored on this record.
The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.
- npm @angular/platform-server<= 19.2.25
- npm @angular/platform-server>= 20.0.0, < 20.3.30
- npm @angular/platform-server>= 21.0.0, < 21.2.22
- npm @angular/platform-server>= 22.0.0, < 22.1.4
How to fix CVE-2026-88058
Upgrade
CVE-2026-88058 lists a fix boundary at 19.2.25. Compare the installed build with that boundary before you change production.
Version check
Affected <= 19.2.25
Advisory
Open the inventory_github record and follow its fix.
Official advisories
What to do
Three questions, each answered from this record only. Confirm the vendor advisory before you patch.
Should you patch?
No confirmed exploitation is on record for CVE-2026-88058. EPSS is 0.28%. Act only if a listed version of SSR XSS via Unescaped is installed.
Which versions are affected?
Compare what you have installed with <= 19.2.25, >= 20.0.0, < 20.3.30, >= 21.0.0, < 21.2.22, >= 22.0.0, < 22.1.4. Compare the installed version with the linked vendor advisory before you change production.
What should an analyst verify?
CWE-116; CWE-79: Cross-site Scripting (XSS). EPSS 0.28%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.
Technology hubs
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Aug 27, 2026 · Maintainer security tabs
Detected
### Summary An XSS vulnerability exists in during server-side rendering (SSR) HTML serialization of DOM nodes ( , ) when nested inside fallback raw-content elements ( , , , ). While processing instruction data escaped to , it did not check for or escape matching closing tags of ancestor fallback elements (e.g., ). When rendered in a browser with scripting enabled, an unescaped closing tag sequence
Sep 10, 2026 · Maintainer security tabs
Updated
### Summary An XSS vulnerability exists in during server-side rendering (SSR) HTML serialization of DOM nodes ( , ) when nested inside fallback raw-content elements ( , , , ). While processing instruction data escaped to , it did not check for or escape matching closing tags of ancestor fallback elements (e.g., ). When rendered in a browser with scripting enabled, an unescaped closing tag sequence
Sources
- Maintainer security tabsVendor advisoryGHSA-j3r3-mxqp-r2p4
### Summary An XSS vulnerability exists in during server-side rendering (SSR) HTML serialization of DOM nodes ( , ) when nested inside fallback raw-content elements ( , , , ). While processing instruction data escaped to , it did not check for or escape matching closing tags of ancestor fallback elements (e.g., ). When rendered in a browser with scripting enabled, an unescaped closing tag sequence
github.com
Freshness
Last verified in this catalog Nov 2, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.
- Maintainer security tabsNov 2, 2026