vulnerability / NVI-00012942 / Revision 1
Angular SSR: XSS via Unescaped Processing Instruction () Nodes in Fallback Raw-Content Elements
GitHub lists this reviewed advisory for @angular/platform-server, @angular/platform-server, @angular/platform-server, @angular/platform-server. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.
This report has not inspected your inventory, configuration, deployed build, reachability or evidence. A catalog listing and a severity score do not establish exposure or compromise.
01 / Meaning
Why it matters
Published affected context helps an owner decide what evidence to gather. This report has not examined your application.
02 / Applicability
The affected context
Affected versions, configuration prerequisites and known exclusions are public. Confirm each one against the deployed service.
@angular/platform-server
source listed>= 22.0.0, < 22.1.4
### Summary An XSS vulnerability exists in `@angular/platform-server` during server-side rendering (SSR) HTML serialization of `ProcessingInstruction` DOM nodes (``, `nodeType === 7`) when nested inside fallback raw-content elements (``, ``, ``, ``). While processing instruction data escaped `>` to `>`, it did not check for or escape matching closing tags of ancestor fallback elements (e.g., ``). When rendered in a browser with scripting enabled, an unescaped closing tag sequence in a processing instruction prematurely closes the fallback raw-content tag and causes subsequent sibling elements to execute as live HTML. ### Technical Description In HTML5 parsing, fallback raw-content elements (``, ``, ``, ``) place the browser's HTML tokenizer into `RAWTEXT` mode. In `RAWTEXT` mode, processing instruction tokens (``) are treated as literal raw text rather than bogus comments, and the parser ignores `>` or `?>`. The only token sequence that terminates the container is an end tag matching the container tag name (`</noscript`, `</iframe`, etc.). During server-side HTML serializ
@angular/platform-server
source listed>= 21.0.0, < 21.2.22
### Summary An XSS vulnerability exists in `@angular/platform-server` during server-side rendering (SSR) HTML serialization of `ProcessingInstruction` DOM nodes (``, `nodeType === 7`) when nested inside fallback raw-content elements (``, ``, ``, ``). While processing instruction data escaped `>` to `>`, it did not check for or escape matching closing tags of ancestor fallback elements (e.g., ``). When rendered in a browser with scripting enabled, an unescaped closing tag sequence in a processing instruction prematurely closes the fallback raw-content tag and causes subsequent sibling elements to execute as live HTML. ### Technical Description In HTML5 parsing, fallback raw-content elements (``, ``, ``, ``) place the browser's HTML tokenizer into `RAWTEXT` mode. In `RAWTEXT` mode, processing instruction tokens (``) are treated as literal raw text rather than bogus comments, and the parser ignores `>` or `?>`. The only token sequence that terminates the container is an end tag matching the container tag name (`</noscript`, `</iframe`, etc.). During server-side HTML serializ
@angular/platform-server
source listed>= 20.0.0, < 20.3.30
### Summary An XSS vulnerability exists in `@angular/platform-server` during server-side rendering (SSR) HTML serialization of `ProcessingInstruction` DOM nodes (``, `nodeType === 7`) when nested inside fallback raw-content elements (``, ``, ``, ``). While processing instruction data escaped `>` to `>`, it did not check for or escape matching closing tags of ancestor fallback elements (e.g., ``). When rendered in a browser with scripting enabled, an unescaped closing tag sequence in a processing instruction prematurely closes the fallback raw-content tag and causes subsequent sibling elements to execute as live HTML. ### Technical Description In HTML5 parsing, fallback raw-content elements (``, ``, ``, ``) place the browser's HTML tokenizer into `RAWTEXT` mode. In `RAWTEXT` mode, processing instruction tokens (``) are treated as literal raw text rather than bogus comments, and the parser ignores `>` or `?>`. The only token sequence that terminates the container is an end tag matching the container tag name (`</noscript`, `</iframe`, etc.). During server-side HTML serializ
@angular/platform-server
source listed<= 19.2.25
### Summary An XSS vulnerability exists in `@angular/platform-server` during server-side rendering (SSR) HTML serialization of `ProcessingInstruction` DOM nodes (``, `nodeType === 7`) when nested inside fallback raw-content elements (``, ``, ``, ``). While processing instruction data escaped `>` to `>`, it did not check for or escape matching closing tags of ancestor fallback elements (e.g., ``). When rendered in a browser with scripting enabled, an unescaped closing tag sequence in a processing instruction prematurely closes the fallback raw-content tag and causes subsequent sibling elements to execute as live HTML. ### Technical Description In HTML5 parsing, fallback raw-content elements (``, ``, ``, ``) place the browser's HTML tokenizer into `RAWTEXT` mode. In `RAWTEXT` mode, processing instruction tokens (``) are treated as literal raw text rather than bogus comments, and the parser ignores `>` or `?>`. The only token sequence that terminates the container is an end tag matching the container tag name (`</noscript`, `</iframe`, etc.). During server-side HTML serializ
03 / Response
What to do next
- investigate
Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.
Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system. GitHub Advisory Database
A fixed release is not deployment evidence.
Check current vendor support and compatibility. After making a change, verify the deployed build and relevant runtime conditions. Keep the evidence, owner and time. An updated lockfile alone does not prove what is running.
04 / Limits
What this report cannot establish
- Customer inventory, deployment, reachability and exploitation have not been inspected.
05 / Provenance
Sources you can inspect
Each assertion retains its source. Mirrored records may repeat one underlying publisher; additional links are not independent corroboration.
- GHSA-j3r3-mxqp-r2p4 ↗
GitHub Advisory Database · vendor advisory
Observed . GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.
Public revision history
Only published revisions appear here. Routine fetches do not create a material-change event.
- Revision 1 ·
First indexed by Null; source disclosure date is shown separately.