CVE-2026-88058

Angular before 20.3.30, 21.2.22, and 22.1.4 has a server-side rendering (SSR) vulnerability in @angular/platform-server. Serialization of untrusted input inside fallback raw-content elements (noscript, iframe, noembed, noframes) fails to escape matching closing tags, enabling arbitrary JavaScript execution.

In Angular prior to 20.3.28, 21.2.20, and 22.1.1, @angular/common HttpTransferCache can cache an authenticated response when Server-Side Rendering (SSR) and hydration use a hierarchical HttpClient configured with withRequestsMadeViaParent. The child TransferCache evaluates an initially anonymous request before delegation, then a parent withInterceptors chain adds an Authorization header, cookie, or API token; although the parent cache skips the authenticated request, the child still stores the private response in TransferState serialized as JSON in the ng-state script. A later unauthenticated or unauthorized visitor can receive the cached HTML containing the earlier authenticated user's sensitive response data.

In Angular prior to 20.3.28, 21.2.20, and 22.1.0, the compiler and runtime in @angular/core and @angular/compiler could omit or select an incorrect sanitizer for security-sensitive directive host bindings because SecurityContext was derived from the declaring directive or component selector rather than the concrete host element. The mismatch is reachable through hostDirectives composition, inherited HostBinding declarations, createComponent with a custom hostElement or dynamic directives, SVG/MathML namespace elements, and tag-neutral selectors such as :not(...). Attacker-controlled href, src, action, xlink:href, or data values can therefore reach DOM attributes without Angular's built-in sanitizer and execute arbitrary JavaScript in the user's browser context.

Angular before 20.3.30, 21.2.22, and 22.1.4 has a server-side rendering (SSR) vulnerability in @angular/platform-server. The resolveUrl and parseUrl utilities call String.prototype.trim(), which removes leading Unicode whitespace after a same-origin check, converting a relative path into an attacker-controlled protocol-relative URL, leading to SSRF and credential disclosure.

Angular prior to versions 20.3.27, 21.2.19, and 22.0.1 contains a vulnerability in the Angular compiler i18n pipeline that permits i18n-onerror and other i18n-on event-handler attributes. This allows a lower-trust translation file to replace a static handler with executable JavaScript.

Angular prior to versions 20.3.27, 21.2.19, and 22.0.7 contains a Cross-Site Scripting (XSS) vulnerability in @angular/platform-server's DOM emulation dependency (domino) when serializing the content of fallback raw-content elements (<iframe>, <noembed>, <noframes>, and <noscript>).

Angular prior to versions 20.3.27, 21.2.19, and 22.0.2 contains a vulnerability in HttpTransferCache that comma-joins repeated request parameters. This allows semantically distinct HttpClient requests to use the same transfer-cache key and reuse a wrong backend response.

A Cross-Site Scripting (XSS) vulnerability exists in Angular's @angular/platform-server component when serializing <noscript> elements during SSR. The domino library fails to escape </noscript> in dynamic content, allowing injection of malicious scripts.

A Cross-Site Scripting (XSS) vulnerability exists in Angular's @angular/platform-server DOM emulation dependency (domino) when serializing raw-text elements like <script>, <style>, and <iframe>. A Unicode index alignment bug causes dynamic text with astral characters (e.g., emojis) before a closing tag to be improperly escaped, allowing JavaScript injection. The flaw is fixed in versions 22.0.0-rc.2, 21.2.16, 20.3.24, and 19.2.25.

A DOM Clobbering vulnerability in Angular allows an attacker to replace the SSR state container (ng-state) by injecting an HTML element with the same ID. During client hydration, Angular reads data from the fake element, potentially leading to code execution or data theft.