CVE-2026-88060

Executive Summary

CVE-2026-88060 is a cross-site scripting (XSS) vulnerability in Angular's server-side rendering (SSR) component @angular/platform-server, affecting versions prior to 20.3.30, 21.2.22, and 22.1.4. The flaw resides in the Domino serializer's handling of fallback raw-content elements, where untrusted input is serialized unescaped inside template content nested within elements such as noscript, iframe, noembed, and noframes. When a browser parses the resulting SSR HTML, it can exit the fallback container and interpret trailing markup as active DOM elements, resulting in arbitrary JavaScript execution in the victim's browser context. Because the vulnerability is exploited via server-rendered HTML delivered to clients, any organization running a vulnerable Angular SSR deployment that reflects untrusted input into affected template contexts is at risk.

Technical Analysis

The vulnerability is a classic improper neutralization of user-controllable input during server-side rendering, mapped to CWE-79 (Improper Neutralization of Input During Web Page Generation). Angular's SSR pipeline uses the Domino library to emulate browser DOM serialization on the server. The serializer contains a traversal routine for "fallback raw content tags" — elements that browsers treat as RAWTEXT or as fallback content containers, namely noscript, iframe, noembed, and noframes.

The defect, as described in the NVD record, is that the fallbackRawContentTags traversal stopped at the DocumentFragment used by template.content. Because that fragment boundary was not traversed, matching closing tags appearing in xmp, style, script, comment nodes, or text nodes nested inside the template content were not escaped during serialization.

From a browser parsing perspective, the impact is significant. HTML5 RAWTEXT parsing states govern how elements such as noscript, xmp, style, and script consume their contents. When a matching closing tag is emitted unescaped inside a fallback raw-content element, the browser's parser exits the fallback container prematurely. Any trailing markup that follows is no longer treated as inert text — it is parsed as active DOM elements. If that markup contains event handlers or script elements, the browser executes attacker-controlled JavaScript.

Three distinct reachability tiers are documented in the description:

1. Standard interpolation with comments or text nodes — reachable without relaxed schemas. This is the lowest-barrier path and applies to conventional Angular templates that interpolate untrusted values near or within comment/text content associated with fallback raw-content elements.
2. Literal xmp or style elements — requires CUSTOM_ELEMENTS_SCHEMA or NO_ERRORS_SCHEMA. Applications that opt into these schemas to suppress unknown-element or unknown-property errors expand the attack surface.
3. Renderer2 imperative DOM construction — unconditionally affected. Applications that build DOM imperatively via Angular's Renderer2 abstraction do not benefit from template-schema restrictions, so the vulnerable serialization path is always reachable.

The CNA title and NVD description do not disclose attacker-controlled entry points, function signatures, or specific API parameters. No public proof-of-concept, Nuclei template, or exploit code is known at the time of this report. The attack chain below is therefore described at the vulnerability-class level.

Exploitation Scenarios

No public PoC is available; the chain below is inferred from the vulnerability class and the NVD description only.

1. Reconnaissance and target identification. An adversary identifies a target running Angular SSR by inspecting response headers, HTML artifacts (e.g., ng-version attributes, _ngcontent- markers), or by fingerprinting the JavaScript bundle. Angular SSR is most common on Node.js-hosted content sites, marketing pages, and dashboards where initial HTML is rendered server-side for SEO or performance. Public Shodan queries (see METADATA) can surface candidate hosts.

2. Triggering the flaw. The attacker locates an SSR-rendered endpoint that interpolates attacker-influenced input — a query parameter, path segment, user profile field, comment, or stored content — into a template whose structure places that value inside or adjacent to a fallback raw-content element (noscript, iframe, noembed, or noframes). If the application has enabled CUSTOM_ELEMENTS_SCHEMA or NO_ERRORS_SCHEMA, an xmp or style literal also serves as a viable container. If the application uses Renderer2 to build these elements imperatively, no schema relaxation is required.

3. Payload and execution. The attacker supplies input containing a matching closing tag for the enclosing fallback element, followed by markup that the browser will interpret as active DOM once parsing exits the fallback container. Because the serializer fails to escape that closing tag inside the template.content fragment, the SSR HTML that reaches the browser contains the unescaped sequence. HTML5 RAWTEXT parsing then terminates the rawtext region early, and the trailing markup is parsed and executed as DOM — typically yielding script execution or event-handler invocation in the context of the victim's session.

4. Post-exploitation. Successful execution grants the attacker arbitrary JavaScript in the victim's browser origin. Standard XSS impact follows: session token theft, authenticated action forgery via CSRF-style requests, exfiltration of DOM-accessible data, keylogging, redirection to phishing or malware, and supply-chain compromise through modification of the rendered page for downstream users. Because Angular SSR is frequently used on pages that also serve authenticated users, the blast radius may include privileged sessions.

Impact Assessment

The vulnerability is network-reachable and executes in the victim's browser, but it requires user interaction (the victim must load the affected SSR page), which is why the vector reflects AC:H and UI:R. The scope is changed (S:C) because the vulnerable component (Angular's SSR serializer) impacts a different security authority (the browser's DOM and the victim's authenticated session). Confidentiality and integrity impacts are high: stolen credentials, forged requests, and manipulated page content are all realistic outcomes. Availability impact is not inherent to the flaw itself.

Business impact includes:

• Session hijacking and account takeover for authenticated users of affected Angular SSR applications.
• Defacement or injected phishing content on high-traffic marketing or documentation sites.
• Regulatory and compliance exposure if user data or session tokens are exfiltrated.
• Reputational damage and downstream compromise of users visiting the affected site.

Blast radius is bounded by which template contexts on the target application reflect untrusted input into the affected element set. Applications using Renderer2 imperative construction against fallback raw-content elements are unconditionally exposed; applications relying on standard interpolation with comment/text nodes near these elements are exposed without schema relaxation.

Note: The CVSS score is reported as N/A (no score published by NVD at the time of this report). The vector above is an analytical assessment based on the vulnerability class and described mechanism, not a vendor-published score. No EPSS score is available.

Detection Guidance

Sigma Rule

title: Angular SSR XSS via Fallback Raw-Content Element Serialization
id: 8f3a2c1e-4b9d-4f2a-9e6c-angular-ssr-xss
status: experimental
description: Detects SSR responses containing unescaped closing tags for fallback raw-content elements, consistent with CVE-2026-88060.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-88060
author: valtersit.com
date: 2026-01-01
logsource:
  category: webserver
  product: generic
detection:
  selection_response:
    cs-method: 'GET'
  selection_body:
    response_body|contains:
      - '</noscript><'
      - '</iframe><'
      - '</noembed><'
      - '</noframes><'
      - '</xmp><'
  condition: selection_response and selection_body
falsepositives:
  - Legitimate iframe or noscript usage in static HTML
level: medium
tags:
  - attack.t1190
  - cwe.79
  - cve.2026.88060

YARA Rule

rule CVE_2026_88060_Angular_SSR_FallbackRawContent_XSS
{
    meta:
        author = "valtersit.com"
        description = "Detects SSR HTML containing unescaped closing tags following fallback raw-content elements, indicative of CVE-2026-88060."
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-88060"
        date = "2026-01-01"
        cve = "CVE-2026-88060"

    strings:
        $t1 = "</noscript><" nocase
        $t2 = "</iframe><" nocase
        $t3 = "</noembed><" nocase
        $t4 = "</noframes><" nocase
        $t5 = "</xmp><" nocase
        $t6 = "</style><" nocase
        $t7 = "</script><" nocase
        $mark = "_ngcontent-" nocase
        $ngv  = "ng-version" nocase
        $evt  = /on[a-z]+\s*=\s*["'][^"']{4,}/ nocase

    condition:
        uint16(0) == 0x3C21 or uint16(0) == 0x3C68 or true
        and ($mark or $ngv)
        and any of ($t1, $t2, $t3, $t4, $t5)
        and $evt
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-88060 Angular SSR XSS - unescaped fallback raw-content close tag in response"; flow:established,from_server; http.response_body; content:"</noscript><"; nocase; http.response_body; content:"_ngcontent-"; nocase; reference:cve,2026-88060; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-88060; classtype:web-application-attack; sid:2026880601; rev:1;)

alert http any any -> any any (msg:"CVE-2026-88060 Angular SSR XSS - fallback iframe/noembed close tag followed by markup"; flow:established,from_server; http.response_body; pcre:"/<\/(iframe|noembed|noframes|xmp)>\s*</i"; reference:cve,2026-88060; classtype:web-application-attack; sid:2026880602; rev:1;)

Elastic Detection

sequence by source.ip
  [ http where http.response.body : "</noscript><" or http.response.body : "</iframe><" or http.response.body : "</noembed><" or http.response.body : "</noframes><" or http.response.body : "</xmp><" ]
  [ http where http.response.body : "onerror=" or http.response.body : "onload=" or http.response.body : "<script" ]

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=nginx:plus:access
| eval resp=_raw
| where match(resp, "(?i)</(noscript|iframe|noembed|noframes|xmp)>\s*<")
| rex field=uri "(?P<param>[?&][a-zA-Z0-9_]+=)"
| stats count min(_time) as first_seen max(_time) as last_seen values(uri) as uris by src_ip, param, host
| where count > 3
| sort - count

Wazuh OSSEC Rule

<group name="web,appsec,cve-2026-88060,">
  <rule id="202688060" level="10">
    <decoded_as>json</decoded_as>
    <field name="http.response.body">\.noscript&gt;&lt;|\.iframe&gt;&lt;|\.noembed&gt;&lt;|\.noframes&gt;&lt;|\.xmp&gt;&lt;</field>
    <description>CVE-2026-88060: Angular SSR response contains unescaped fallback raw-content closing tag (possible XSS)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_88060,xss,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). Note: NVD lists fixed versions (20.3.30, 21.2.22, 22.1.4), but no vendor advisory, commit, or patch source was tracked in the intelligence feed used for this report. Verify fixes against official Angular release channels before relying on them.

1. Immediate mitigations

• Audit all Angular SSR templates for interpolation of untrusted input inside or adjacent to noscript, iframe, noembed, and noframes elements.
• Remove CUSTOM_ELEMENTS_SCHEMA and NO_ERRORS_SCHEMA from modules that handle untrusted data; these schema relaxations broaden the exploitable surface to xmp and style literals.
• Where feasible, migrate imperative DOM construction of fallback raw-content elements away from Renderer2 pending patch availability, or sanitize inputs before they reach the renderer.
• Apply a strict Content Security Policy (CSP) with script-src restricted to trusted origins and nonces; this does not remove the flaw but materially constrains script execution if parsing escapes the container.
• Add a reverse-proxy or WAF rule that rejects responses containing unescaped closing tags for the affected element set (see Suricata rule above).

2. Patch / upgrade steps

• If an official Angular release is confirmed to contain the fix, upgrade @angular/platform-server to 20.3.30, 21.2.22, or 22.1.4 (or later) on the corresponding major branch.
• Rebuild, redeploy, and re-run the SSR smoke tests across all major browsers to confirm the serializer now escapes matching closing tags inside template.content.
• Monitor the Angular changelog and GitHub security advisories for the canonical patch reference before treating any version as definitively fixed.

3. Long-term hardening

• Enforce framework-level sanitization as a default rather than opt-in; avoid relaxation schemas entirely in production code paths.
• Adopt output encoding at the template compiler boundary and continuous fuzzing of the SSR serializer against raw-content elements.
• Instrument SSR responses with detection rules above and alert on any occurrence of unescaped closing tags in the target element set.
• Track CVE-2026-88060 in your SBOM and dependency-scanning pipeline; treat @angular/platform-server as a high-priority component.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-88060
• Angular official releases and changelog (verify applicable fixed versions 20.3.30, 21.2.22, 22.1.4)
• FIRST EPSS: not yet scored at time of this report — https://www.first.org/epss/
• CWE-79: Improper Neutralization of Input During Web Page Generation — https://cwe.mitre.org/data/definitions/79.html
• CISA Known Exploited Vulnerabilities Catalog: no entry for CVE-2026-88060 as of this report — https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No threat actor campaign or exploit-in-the-wild evidence was identified in the intelligence feed used for this report.