Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.30, 21.2.22, and 22.1.4, Angular server-side rendering (SSR) in @angular/platform-server serializes untrusted input inside template content nested in fallback raw-content elements such as noscript, iframe, noembed, and noframes. The Domino serializer's fallbackRawContentTags traversal stopped at the DocumentFragment used by template.content, so matching closing tags in xmp, style, script, comments, or text nodes were not escaped. Standard interpolation with comments or text nodes is reachable without relaxed schemas; literal xmp or style requires CUSTOM_ELEMENTS_SCHEMA or NO_ERRORS_SCHEMA, while Renderer2 imperative DOM construction is unconditionally affected. When HTML5 RAWTEXT browser parsing encounters the unescaped closing tag, it exits the fallback container and interprets trailing markup as active DOM elements, enabling arbitrary JavaScript execution. This issue is fixed in versions 20.3.30, 21.2.22, and 22.1.4.

According to its self-reported version number, Angular is prior to 20.0.0, 20.x prior to 20.3.30, 21.x prior to 21.2.22 or 22.x prior to 22.1.4. It is, therefore, affected by multiple vulnerabilities:

- A Server-Side Request Forgery (SSRF) vulnerability in @angular/platform-server. A discrepancy between WHATWG URL parsing and the Angular SSR URL resolution, which strips leading Unicode whitespace, allows an attacker to bypass same-origin checks and send server-side requests to an attacker-controlled host, potentially leaking server-side credentials. (CVE-2026-88056)

- A Cross-Site Scripting (XSS) vulnerability in @angular/platform-server. During SSR HTML serialization, processing instruction nodes nested inside fallback raw-content elements (such as <noscript> or <iframe>) do not escape the matching closing tag of the ancestor element, allowing injected markup to execute in the browser. (CVE-2026-88058)

- A Cross-Site Scripting (XSS) vulnerability in @angular/platform-server. During SSR HTML serialization, ancestor tags are not traversed across <template> element boundaries, so closing tags of fallback raw-content elements (such as </noscript>) in untrusted content are not escaped, allowing injected markup to execute in the browser. (CVE-2026-88060)

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Angular is a development platform for building mobile and desktop web applications using
    TypeScript/JavaScript and other languages. Prior to 20.3.30, 21.2.22, and 22.1.4, Angular server-side
    rendering (SSR) in @angular/platform-server serializes untrusted input inside template content nested in
    fallback raw-content elements such as noscript, iframe, noembed, and noframes. The Domino serializer's
    fallbackRawContentTags traversal stopped at the DocumentFragment used by template.content, so matching
    closing tags in xmp, style, script, comments, or text nodes were not escaped. Standard interpolation with
    comments or text nodes is reachable without relaxed schemas; literal xmp or style requires
    CUSTOM_ELEMENTS_SCHEMA or NO_ERRORS_SCHEMA, while Renderer2 imperative DOM construction is unconditionally
    affected. When HTML5 RAWTEXT browser parsing encounters the unescaped closing tag, it exits the fallback
    container and interprets trailing markup as active DOM elements, enabling arbitrary JavaScript execution.
    This issue is fixed in versions 20.3.30, 21.2.22, and 22.1.4. (CVE-2026-88060)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Angular is a development platform for building mobile and desktop web applications using     TypeScript/JavaScript and other languages. Prior to 20.3.30, 21.2.22, and 22.1.4, Angular server-side     rendering (SSR) in @angular/platform-server serializes untrusted input inside template content nested in     fallback raw-content elements such as noscript, iframe, noembed, and noframes. The Domino serializer's     fallbackRawContentTags traversal stopped at the DocumentFragment used by template.content, so matching     closing tags in xmp, style, script, comments, or text nodes were not escaped. Standard interpolation with     comments or text nodes is reachable without relaxed schemas; literal xmp or style requires     CUSTOM_ELEMENTS_SCHEMA or NO_ERRORS_SCHEMA, while Renderer2 imperative DOM construction is unconditionally     affected. When HTML5 RAWTEXT browser parsing encounters the unescaped closing tag, it exits the fallback     container and interprets trailing markup as active DOM elements, enabling arbitrary JavaScript execution.
    This issue is fixed in versions 20.3.30, 21.2.22, and 22.1.4. (CVE-2026-88060)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
115580	Angular < 20.3.30 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	high
115579	Angular 20.x < 20.3.30 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	high
115578	Angular 21.x < 21.2.22 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	high
115577	Angular 22.x < 22.1.4 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	high
447942	SCA: security update for @angular/platform-server (GHSA-v3p8-whq6-r5jg)	Tenable Cloud Security	SCA Checks	Local	high
447942	SCA: security update for @angular/platform-server (GHSA-v3p8-whq6-r5jg)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
344714	Linux Distros Unpatched Vulnerability : CVE-2026-88060	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-88060

high

Tenable Plugins

high

high

high

high

high

high

high