Angular Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) Vulnerability - CVE-2026-54267

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.1 21.2.17 and 20.3.25 to optimize client-side bootstrap in Server-Side Rendered (SSR) environments Angular supports Hydration via provideClientHydration(). During SSR Angular serializes the application39s runtime state (such as cached HttpClient responses) and outputs it into the HTML stream as a ltscriptgt tag with a predictable identifier. During client bootstrap Angular recovers this state by looking up the element via document.getElementById(39ng-state39) and parsing its text content. Because the DOM element lookup for the state container is predictable and relies solely on the ID selector (ng-state) it is susceptible to DOM Clobbering. If the application binds untrusted user input or CMS content to element properties such as id (e.g. ltdiv idquotuserInputquotgt or lta idquotng-statequotgt) before the genuine ltscriptgt tag is parsed by the browser the attacker-controlled element takes precedence in the DOM lookup. During hydration when Angular calls document.getElementById(39ng-state39) the browser returns the attacker39s clobbered element. Angular then attempts to parse the text content or attributes of this clobbered element as JSON. This vulnerability is fixed in 22.0.1 21.2.17 and 20.3.25.