THREATOPS

THREAT OPS › Threat News › [GHSA] GHSA-v3p8-whq6-r5jg (high) — Angular: SSR XSS via Unescaped <template> Content Across DocumentFragment Boundaries in Fallback Raw-Content Elements

[GHSA] GHSA-v3p8-whq6-r5jg (high) — Angular: SSR XSS via Unescaped <template> Content Across DocumentFragment Boundaries in Fallback Raw-Content Elements

medgithub_advisoriesPublished 2026-09-10

GHSA-v3p8-whq6-r5jg Severity: high CVE: CVE-2026-88060

Angular: SSR XSS via Unescaped <template> Content Across DocumentFragment Boundaries in Fallback Raw-Content Elements

### Summary An XSS vulnerability exists in `@angular/platform-server` during server-side rendering (SSR) HTML serialization when traversing ancestor tags across `<template>` element boundaries. When an application renders unt

Indicators of compromise

CVE-2026-88060cve

Original source: https://github.com/advisories/GHSA-v3p8-whq6-r5jg