CVE-2026-88060

### Summary An XSS vulnerability exists in `@angular/platform-server` during server-side rendering (SSR) HTML serialization when traversing ancestor tags across `<template>` element boundaries. When an application renders untrusted user input within raw-text tags (`<xmp>`, `<style>`, `<script>`), comments, or text nodes inside a `<template>` that is nested within a fallback raw-content element (`<noscript>`, `<iframe>`, `<noembed>`, `<noframes>`), matching closing tags (e.g., `</noscript>`) are not escaped during HTML serialization. When rendered in a browser, this unescaped closing tag prematurely terminates the fallback container and executes trailing markup as active DOM elements. ### Technical Description In HTML5 parsing, fallback raw-content elements (`<noscript>`, `<iframe>`, `<noembed>`, `<noframes>`) place the browser's tokenizer into `RAWTEXT` mode. In this mode, inner content is parsed as literal text until an end tag matching the container tag name (e.g., `</noscript>`) is encountered. To prevent XSS breakout vectors during SSR serialization, the DOM serializer inspects a node's ancestors to escape any matching fallback closing tags (`</tag` -> `&lt;/tag`). However: 1. Per DOM specifications, the children of a `<template>` element reside in a separate `DocumentFragment` (`template.content`), whose own `parentNode` is `null`. 2. The serializer's ancestor traversal previously only inspected element nodes. When traversing upward from a node inside `template.content`, traversal terminated immediately at the `DocumentFragment` boundary. 3. Because traversal stopped before reaching the outer document tree, enclosing fallback raw-content ancestors (such as `<noscript>` or `<iframe>`) were not discovered. As a result, closing sequences like `</noscript>` within `<template>` content were emitted unescaped. ### Impact & Reachability * **Framework Guarantee Bypass**: Angular guarantees that standard text interpolation (`{{ userInput }}` bound as element text con