{"action":"Upgrade @angular/platform-server to 20.3.30 or later.","affected":[{"fixed":"22.1.4","introduced":"22.0.0"},{"fixed":"21.2.22","introduced":"21.0.0"},{"fixed":"20.3.30","introduced":"20.0.0"},{"introduced":"0","last_affected":"19.2.25"}],"component":"@angular/platform-server","cve_ids":["CVE-2026-88060"],"ecosystem":"npm","epss":0.00362,"exploited":false,"fixed_versions":["22.1.4","21.2.22","20.3.30"],"ghsa_id":"GHSA-v3p8-whq6-r5jg","id":"tcs_01M5KGAK9M6GBVXB3506DA8WEM","modified_at":"2026-09-25T05:30:06.082483620Z","published_at":"2026-09-10T20:25:25Z","references":["https://osv.dev/vulnerability/GHSA-v3p8-whq6-r5jg","https://github.com/angular/angular/security/advisories/GHSA-v3p8-whq6-r5jg","https://github.com/angular/angular/commit/73d8bbd27cb46495426d4132975a1355b47ad915","https://github.com/angular/angular/commit/89b20568dfaee1ec8e0b3bcf1872acdddd2f4fef","https://github.com/angular/angular/commit/ba3bc47b20b3d12f5eb141ec9c651373ae4d15e8","https://github.com/angular/domino/commit/04f987dc08ff3736b427f50941adf1722458528f","https://github.com/angular/angular","https://github.com/angular/angular/releases/tag/v20.3.30","https://github.com/angular/angular/releases/tag/v21.2.22","https://github.com/angular/angular/releases/tag/v22.1.4"],"severity":{"label":"medium","score":6.1},"sources":[{"source":"osv","source_id":"GHSA-v3p8-whq6-r5jg","url":"https://osv.dev/vulnerability/GHSA-v3p8-whq6-r5jg"},{"source":"nvd","source_id":"CVE-2026-88060","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88060"}],"summary":"Angular: SSR XSS via Unescaped <template> Content Across DocumentFragment Boundaries in Fallback Raw-Content Elements"}