CVE-2026-88058

Executive Summary

CVE-2026-88058 is an HTML-injection-to-XSS vulnerability in Angular's server-side rendering (SSR) package @angular/platform-server that affects versions prior to 20.3.30, 21.2.22, and 22.1.4. During SSR, serialization of ProcessingInstruction DOM nodes inside fallback raw-content elements (such as noscript, iframe, noembed, noframes) fails to escape matching ancestor closing tags, allowing inserted data to prematurely close the raw-text container and cause subsequent sibling markup to be parsed as live HTML. This enables arbitrary JavaScript execution in a victim's browser, but reachability requires application or library code that creates such nodes with attacker-controlled data via inject(DOCUMENT).createProcessingInstruction or Renderer2 DOM insertion inside a fallback container — it cannot be authored through standard Angular templates. No public PoC, exploit code, or CISA KEV listing is currently available, and the issue is considered UNPATCHED in tracked sources despite version-level fixes being noted.

Technical Analysis

Angular's SSR pipeline serializes the rendered DOM tree to a string that is streamed to the client for hydration. For elements recognized as HTML5 RAWTEXT containers — specifically noscript, iframe, noembed, and noframes — the serializer must preserve the raw contents verbatim while ensuring the container's own closing tag cannot be forged from within. ProcessingInstruction (PI) nodes are a distinct DOM node type whose data is expected to be serialized with certain character escapes; according to the description, PI data escaped the greater-than character (>) but left the less-than character (<) untouched. Critically, the serializer did not inspect ancestor context to determine whether a PI node resided inside one of the fallback raw-content containers.

The consequence is a mismatch between the serializer's assumptions and the HTML5 parser's behavior. The HTML5 specification's RAWTEXT parsing state consumes characters literally until it encounters a matching closing tag sequence for the enclosing element. If PI data contains a string that matches the enclosing element's closing tag (for example, a sequence that closes noscript), the browser's parser exits the raw-text state at that point. Any markup that follows the prematurely closed container is then interpreted as ordinary, live HTML rather than as inert text. This is precisely the classic escape-from-RAWTEXT-to-HTML-injection-to-XSS pattern: inert content becomes executable script when the containment boundary is broken.

The reachability constraint is significant and is stated explicitly in the advisory. Vulnerable nodes "cannot be authored through standard Angular templates." An attacker cannot simply supply a template string to trigger this. Reaching the vulnerable code path requires application or library code that either calls inject(DOCUMENT).createProcessingInstruction with attacker-controlled data or performs Renderer2 DOM insertion of a vulnerable node inside a fallback container. This means the vulnerability is only present in applications whose own code (or a third-party library they depend on) constructs such nodes. Where that condition holds and the input is attacker-controlled, a premature close of the fallback container leads to arbitrary JavaScript execution in the victim's browser during or after SSR output is delivered.

The fix, applied in 20.3.30, 21.2.22, and 22.1.4, presumably ensures that the less-than character is escaped within PI data and/or that the serializer inspects fallback ancestors so that no PI data can emit a sequence matching an enclosing raw-text closing tag. The advisory does not disclose the exact patch implementation, and no patch source or commit is tracked in the supplied data, so the precise code change should be confirmed against the vendor release notes.

Exploitation Scenarios

No public PoC is available; the attack chain is inferred from the vulnerability class (CWE-79 via HTML injection from a broken RAWTEXT boundary) and the constraints stated in the NVD description.

1. Reconnaissance / target identification. An attacker identifies an Angular SSR application (typically evidenced by SSR-delivered HTML, @angular/platform-server usage, and hydration attributes in the response) running a version below 20.3.30, 21.2.22, or 22.1.4. The attacker then looks for application features that render server-side content inside noscript, iframe, noembed, or noframes fallback containers and that inject data into ProcessingInstruction nodes — i.e., a code path using inject(DOCUMENT).createProcessingInstruction or Renderer2 insertion. This is the hardest step: without such a code path, the flaw is not reachable.

2. Triggering the flaw. The attacker supplies input that flows into the data of a ProcessingInstruction node created inside a fallback raw-content element. Because PI data escapes > but not <, the attacker's input can include a less-than character followed by a sequence matching the enclosing container's closing tag. The SSR serializer emits this PI data inside the noscript/iframe/noembed/noframes container without recognizing that it will terminate the raw-text region.

3. Payload / execution method. When the browser parses the SSR-delivered HTML, the HTML5 RAWTEXT parser exits the container early upon encountering the forged closing tag. Sibling markup that was intended to be inert (or that the attacker can now influence) is parsed as live HTML. Per the advisory, this enables arbitrary JavaScript execution in a victim's browser — i.e., an HTML-injection-to-XSS primitive. The exact payload depends on what sibling content is present and is not specified in the advisory; the vulnerability class permits script or event-handler injection that the browser then executes in the application's origin.

4. Post-exploitation impact. Because the script executes in the origin of the SSR application, the attacker can act with that origin's privileges — for example, reading accessible DOM/session context, performing authenticated actions as the victim, exfiltrating data the application exposes, or delivering phishing content within a trusted domain. As a client-side XSS, the confirmed scope is limited to the victim's browser session; the advisory does not describe server-side compromise.

The practical exploitation barrier is the code-path precondition. Applications that never create ProcessingInstruction nodes inside fallback containers with untrusted data are not affected in practice, even if running a vulnerable package version. Applications that do — or that depend on a library doing so — should treat this as a genuine cross-site scripting risk.

Impact Assessment

Impact is cross-site scripting in the context of an Angular SSR-rendered page. Using the provided vector CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N, the attack is network-delivered with high attack complexity (reflecting the need for a specific, non-standard code path and the difficulty of crafting a working payload against the parser), requires no privileges, and requires user interaction (the victim must load the malicious SSR output). The scope is changed (S:C), consistent with script execution in the browser affecting resources beyond the vulnerable component, with low confidentiality and integrity impact and no availability impact. Note that the NVD record lists no numeric score; the supplied vector is the only guidance and should be treated as provisional.

Business impact centers on client-side session integrity and data exposure in the affected application's origin. XSS can enable session theft, unauthorized actions as a victim, credential phishing within a trusted domain, and defacement of SSR-rendered views. Blast radius is constrained by reachability: only deployments of @angular/platform-server below the fixed versions that also route attacker-controlled data into ProcessingInstruction nodes inside fallback raw-content containers are exploitable. Because the precondition is application-specific, the effective vulnerability rate across the installed base is likely far lower than the raw "unpatched" status implies, but organizations running the affected package versions cannot assume their code avoids the pattern without review.

Detection Guidance

Sigma Rule

title: Potential Angular SSR RAWTEXT Breakout via ProcessingInstruction Data
id: 3f9a2c1e-8b4d-4e6a-9c01-angularssrpi
status: experimental
description: Detects HTTP responses containing fallback raw-content container closing sequences embedded within content that appears to originate from server-side rendered markup, indicative of CVE-2026-88058 exploitation attempts.
logsource:
  category: webserver
detection:
  selection_container:
    - response_body|contains: '</noscript'
    - response_body|contains: '</iframe'
    - response_body|contains: '</noembed'
    - response_body|contains: '</noframes'
  selection_marker:
    response_body|contains:
      - '<'
  condition: selection_container and selection_marker
falsepositives:
  - Legitimate applications that intentionally emit closing tags for these elements
  - Framework- or template-generated noscript fallbacks
level: low
tags:
  - attack.t1190
  - cwe.79

YARA Rule

rule CVE_2026_88058_Angular_SSR_RAWTEXT_Breakout
{
    meta:
        description = "Detects Angular SSR output where ProcessingInstruction data may break out of fallback raw-content elements (CVE-2026-88058)."
        author = "valtersit.com"
        date = "2026-01-01"
        cve = "CVE-2026-88058"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-88058"
    strings:
        $c1 = "<noscript" nocase
        $c2 = "<iframe" nocase
        $c3 = "<noembed" nocase
        $c4 = "<noframes" nocase
        $close_noscript = "</noscript" nocase
        $close_iframe   = "</iframe" nocase
        $close_noembed  = "</noembed" nocase
        $close_noframes = "</noframes" nocase
        $pi_marker = "<?" ascii
        $script = "<script" nocase
        $onerr = "onerror=" nocase
    condition:
        any of ($c1, $c2, $c3, $c4) and
        any of ($close_noscript, $close_iframe, $close_noembed, $close_noframes) and
        ($pi_marker or $script or $onerr)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-88058 Angular SSR RAWTEXT Breakout Attempt"; flow:established,to_client; http.response_body; content:"</noscript"; nocase; content:"<"; within:200; pcre:"/(<noscript|<iframe|<noembed|<noframes)/iR"; reference:cve,2026-88058; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-88058; classtype:web-application-attack; sid:202688058; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=30s
  [ network where http.response.status_code == 200 and
      ( http.response.body : "</noscript" or http.response.body : "</iframe"
        or http.response.body : "</noembed" or http.response.body : "</noframes" ) ]
  [ network where http.response.body : "<script" or http.response.body : "onerror=" ]

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=stream:http
| eval body=_raw
| where (match(body, "(?i)</noscript") OR match(body, "(?i)</iframe") OR match(body, "(?i)</noembed") OR match(body, "(?i)</noframes"))
| where (match(body, "(?i)<script") OR match(body, "(?i)onerror=") OR match(body, "<\\?"))
| stats count min(_time) as first_seen max(_time) as last_seen values(uri_path) as paths by src_ip
| sort - count

Note: body inspection requires stream:http or a response-body logging source; raw access logs generally do not contain response bodies.

Wazuh OSSEC Rule

<group name="web,angular,cve-2026-88058,">
  <rule id="2026880" level="6">
    <decoded_as>json</decoded_as>
    <field name="response_body">\.?\</noscript|\.?</iframe|\.?</noembed|\.?</noframes</field>
    <description>CVE-2026-88058 possible Angular SSR RAWTEXT breakout: fallback container closing sequence in response body</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
  <rule id="2026881" level="10">
    <if_sid>2026880</if_sid>
    <field name="response_body">\<script|onerror=|<\?</field>
    <description>CVE-2026-88058 probable exploitation: script or ProcessingInstruction data with fallback container close</description>
  </rule>
</group>

Note: these rules require a decoder that makes the HTTP response body available in the response_body field.

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). The NVD description states the issue is fixed in versions 20.3.30, 21.2.22, and 22.1.4, but no vendor advisory, commit, or patch source is tracked in the supplied data, and the CVE remains unpatched per tracked sources. Verify fixes against official Angular release notes before relying on them.

1. Immediate mitigations.

   • Inventory all applications and libraries using @angular/platform-server; identify those below the fixed versions.
   • Audit code for inject(DOCUMENT).createProcessingInstruction and Renderer2 DOM insertion, especially any usage inside noscript, iframe, noembed, or noframes fallback containers. If such code accepts attacker-controlled data, sanitize or reject < characters in the data before node creation.
   • If the vulnerable code path cannot be removed quickly, deploy a Content-Security-Policy with strict script-src (e.g., nonce- or hash-based) to reduce the likelihood of successful script execution, and apply output encoding at the input source feeding the node creation.
   • Monitor SSR-delivered responses for unexpected closing-tag sequences inside fallback containers using the detection rules above.

2. Patch / upgrade steps.

   • Upgrade @angular/platform-server (and the Angular framework) to 20.3.30, 21.2.22, or 22.1.4 — or the corresponding fixed line for your major version — per the advisory. Confirm the fix in official release notes since no patch source is tracked here.
   • Rebuild and redeploy SSR applications after upgrade; verify no custom code re-introduces PI creation with untrusted data.

3. Long-term hardening.

   • Treat any DOM-node creation path that accepts external input as a sanitization boundary; apply context-aware output encoding.
   • Adopt CSP with nonce/hash-based script policy as defense in depth against XSS.
   • Add static analysis / code review gates that flag createProcessingInstruction and Renderer2 insertion with untrusted sources.
   • Track Angular security advisories and establish a routine upgrade cadence for framework dependencies.

References

• NVD — CVE-2026-88058: https://nvd.nist.gov/vuln/detail/CVE-2026-88058
• Angular security/release notes (verify fixed versions 20.3.30, 21.2.22, 22.1.4): https://angular.dev/
• OWASP — XSS Prevention Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html
• HTML Standard — RAWTEXT parsing state (for the containment mechanism): https://html.spec.whatwg.org/multipage/parsing.html
• CISA KEV Catalog (no entry for this CVE at time of writing): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Note: No public PoC, exploit code, Nuclei template, or threat-actor campaign is associated with CVE-2026-88058 in the supplied data. No exploit-in-the-wild evidence is available. The CVE is not listed in CISA KEV.