{"action":"Upgrade @angular/platform-server to 20.3.30 or later.","affected":[{"fixed":"22.1.4","introduced":"22.0.0"},{"fixed":"21.2.22","introduced":"21.0.0"},{"fixed":"20.3.30","introduced":"20.0.0"},{"introduced":"0","last_affected":"19.2.25"}],"component":"@angular/platform-server","cve_ids":["CVE-2026-88058"],"ecosystem":"npm","epss":0.00281,"exploited":false,"fixed_versions":["22.1.4","21.2.22","20.3.30"],"ghsa_id":"GHSA-j3r3-mxqp-r2p4","id":"tcs_01M5KFWR327CTPGEZ4F2XVRJT8","modified_at":"2026-09-28T20:45:04.134330777Z","published_at":"2026-09-28T20:39:26Z","references":["https://osv.dev/vulnerability/GHSA-j3r3-mxqp-r2p4","https://github.com/angular/angular/security/advisories/GHSA-j3r3-mxqp-r2p4","https://nvd.nist.gov/vuln/detail/CVE-2026-88058","https://github.com/angular/angular/issues/70146","https://github.com/angular/angular/commit/73d8bbd27cb46495426d4132975a1355b47ad915","https://github.com/angular/angular/commit/89b20568dfaee1ec8e0b3bcf1872acdddd2f4fef","https://github.com/angular/angular/commit/ba3bc47b20b3d12f5eb141ec9c651373ae4d15e8","https://github.com/angular/domino/commit/04f987dc08ff3736b427f50941adf1722458528f","https://github.com/angular/angular","https://github.com/angular/angular/releases/tag/v20.3.30","https://github.com/angular/angular/releases/tag/v21.2.22","https://github.com/angular/angular/releases/tag/v22.1.4"],"severity":{"label":"high"},"sources":[{"source":"osv","source_id":"GHSA-j3r3-mxqp-r2p4","url":"https://osv.dev/vulnerability/GHSA-j3r3-mxqp-r2p4"}],"summary":"Angular SSR: XSS via Unescaped Processing Instruction (<?...?>) Nodes in Fallback Raw-Content Elements"}