CVE-2026-88060
1 advisory.
npm/@angular/platform-server CVE-2026-88060: high
Angular: SSR XSS via Unescaped <template> Content Across DocumentFragment Boundaries in Fallback Raw-Content Elements
Action: Upgrade @angular/platform-server to 20.3.30 or later.
npm i @angular/platform-server@22.1.4npm i @angular/platform-server@21.2.22npm i @angular/platform-server@20.3.30Affected
| introduced | fixed | last affected |
|---|---|---|
| 22.0.0 | 22.1.4 | - |
| 21.0.0 | 21.2.22 | - |
| 20.0.0 | 20.3.30 | - |
| 0 | - | 19.2.25 |
Fixed versions
| 22.1.4 | 21.2.22 | 20.3.30 |
Sources
- osv: GHSA-v3p8-whq6-r5jg
- https://github.com/angular/angular/security/advisories/GHSA-v3p8-whq6-r5jg
- https://github.com/angular/angular/commit/73d8bbd27cb46495426d4132975a1355b47ad915
- https://github.com/angular/angular/commit/89b20568dfaee1ec8e0b3bcf1872acdddd2f4fef
- https://github.com/angular/angular/commit/ba3bc47b20b3d12f5eb141ec9c651373ae4d15e8
- https://github.com/angular/domino/commit/04f987dc08ff3736b427f50941adf1722458528f
- https://github.com/angular/angular
- https://github.com/angular/angular/releases/tag/v20.3.30
- https://github.com/angular/angular/releases/tag/v21.2.22
- https://github.com/angular/angular/releases/tag/v22.1.4
CVE-2026-88060 · published · modified · JSON