This vulnerability allows an attacker to inject unescaped ProcessingInstruction nodes into server‑side rendered content. Because the node data is not fully escaped, a less‑than character can prematurely close enclosing raw‑content elements such as <noscript> or <iframe>, causing following HTML to be parsed as live markup. As a result, an attacker can execute arbitrary JavaScript in the victim’s browser, resulting in a cross‑site scripting (XSS) vulnerability. The flaw is related to CWE‑116 and CWE‑79.

Angular applications that use the @angular/platform-server package prior to v20.3.30, v21.2.22, or v22.1.4 are vulnerable. The flaw occurs only when application or library code creates ProcessingInstruction nodes via inject(DOCUMENT).createProcessingInstruction with attacker‑controlled data, or uses Renderer2 to insert raw HTML into fallback containers. Client‑only Angular applications are not affected.

The vulnerability can be leveraged by serving a malicious SSR payload that contains a crafted ProcessingInstruction node. The exploit requires the attacker to influence the content that the server renders; therefore, it is most relevant for dynamic content that the application exposes to users. The CVSS score of 8.6 reflects a high impact and high exploitability, though the EPSS score is not available, so the current exploitation probability is unknown. The issue is not listed in CISA’s KEV catalog, but it remains a serious concern for all affected Angular deployments and should be remediated quickly.