Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.30, 21.2.22, and 22.1.4, Angular server-side rendering (SSR) in @angular/platform-server serializes ProcessingInstruction DOM nodes inside fallback raw-content elements without escaping matching ancestor closing tags. ProcessingInstruction data escaped greater-than characters but left less-than characters untouched and did not inspect fallback ancestors, so data such as a matching closing tag prematurely terminates noscript, iframe, noembed, or noframes containers. The vulnerable nodes cannot be authored through standard Angular templates; reachability requires application or library code using inject(DOCUMENT).createProcessingInstruction with attacker-controlled data or Renderer2 DOM insertion inside a fallback container. In HTML5 RAWTEXT parsing, the premature close causes subsequent sibling elements to be interpreted as live HTML and enables arbitrary JavaScript execution in a victim's browser. This issue is fixed in versions 20.3.30, 21.2.22, and 22.1.4.

According to its self-reported version number, Angular is prior to 20.0.0, 20.x prior to 20.3.30, 21.x prior to 21.2.22 or 22.x prior to 22.1.4. It is, therefore, affected by multiple vulnerabilities:

- A Server-Side Request Forgery (SSRF) vulnerability in @angular/platform-server. A discrepancy between WHATWG URL parsing and the Angular SSR URL resolution, which strips leading Unicode whitespace, allows an attacker to bypass same-origin checks and send server-side requests to an attacker-controlled host, potentially leaking server-side credentials. (CVE-2026-88056)

- A Cross-Site Scripting (XSS) vulnerability in @angular/platform-server. During SSR HTML serialization, processing instruction nodes nested inside fallback raw-content elements (such as <noscript> or <iframe>) do not escape the matching closing tag of the ancestor element, allowing injected markup to execute in the browser. (CVE-2026-88058)

- A Cross-Site Scripting (XSS) vulnerability in @angular/platform-server. During SSR HTML serialization, ancestor tags are not traversed across <template> element boundaries, so closing tags of fallback raw-content elements (such as </noscript>) in untrusted content are not escaped, allowing injected markup to execute in the browser. (CVE-2026-88060)

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Angular is a development platform for building mobile and desktop web applications using
    TypeScript/JavaScript and other languages. Prior to 20.3.30, 21.2.22, and 22.1.4, Angular server-side
    rendering (SSR) in @angular/platform-server serializes ProcessingInstruction DOM nodes inside fallback
    raw-content elements without escaping matching ancestor closing tags. ProcessingInstruction data escaped
    greater-than characters but left less-than characters untouched and did not inspect fallback ancestors, so
    data such as a matching closing tag prematurely terminates noscript, iframe, noembed, or noframes
    containers. The vulnerable nodes cannot be authored through standard Angular templates; reachability
    requires application or library code using inject(DOCUMENT).createProcessingInstruction with attacker-
    controlled data or Renderer2 DOM insertion inside a fallback container. In HTML5 RAWTEXT parsing, the
    premature close causes subsequent sibling elements to be interpreted as live HTML and enables arbitrary
    JavaScript execution in a victim's browser. This issue is fixed in versions 20.3.30, 21.2.22, and 22.1.4.
    (CVE-2026-88058)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Angular is a development platform for building mobile and desktop web applications using     TypeScript/JavaScript and other languages. Prior to 20.3.30, 21.2.22, and 22.1.4, Angular server-side     rendering (SSR) in @angular/platform-server serializes ProcessingInstruction DOM nodes inside fallback     raw-content elements without escaping matching ancestor closing tags. ProcessingInstruction data escaped     greater-than characters but left less-than characters untouched and did not inspect fallback ancestors, so     data such as a matching closing tag prematurely terminates noscript, iframe, noembed, or noframes     containers. The vulnerable nodes cannot be authored through standard Angular templates; reachability     requires application or library code using inject(DOCUMENT).createProcessingInstruction with attacker-     controlled data or Renderer2 DOM insertion inside a fallback container. In HTML5 RAWTEXT parsing, the     premature close causes subsequent sibling elements to be interpreted as live HTML and enables arbitrary     JavaScript execution in a victim's browser. This issue is fixed in versions 20.3.30, 21.2.22, and 22.1.4.
    (CVE-2026-88058)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
115580	Angular < 20.3.30 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	high
115579	Angular 20.x < 20.3.30 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	high
115578	Angular 21.x < 21.2.22 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	high
115577	Angular 22.x < 22.1.4 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	high
448444	SCA: security update for @angular/platform-server (GHSA-j3r3-mxqp-r2p4)	Tenable Cloud Security	SCA Checks	Local	high
448444	SCA: security update for @angular/platform-server (GHSA-j3r3-mxqp-r2p4)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
344692	Linux Distros Unpatched Vulnerability : CVE-2026-88058	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-88058

high

Tenable Plugins

high

high

high

high

high

high

high