Angular : Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) Vuln - CVE-2026-88060 - Vulnerability Database

Angular

Angular : Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) Vuln - CVE-2026-88060

Medium

Reference: CVE-2026-88060

NVD Link: https://nvd.nist.gov/vuln/detail/CVE-2026-88060

Title: Angular : Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) Vuln

Overview:

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.30 21.2.22 and 22.1.4 Angular server-side rendering (SSR) in angular/platform-server serializes untrusted input inside template content nested in fallback raw-content elements such as noscript iframe noembed and noframes. The Domino serializers fallbackRawContentTags traversal stopped at the DocumentFragment used by template.content so matchin