PT-2026-49247 · Google · Angular
CVSS v4.0
8.6
High
| Vector | AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
Angular versions prior to 22.0.1
Angular versions prior to 21.2.17
Angular versions prior to 20.3.25
Description
Angular supports Hydration via
provideClientHydration() to optimize client-side bootstrap in Server-Side Rendered (SSR) environments. During SSR, the application's runtime state, such as cached HttpClient responses, is serialized and output as a <script> tag with the predictable identifier ng-state. During client bootstrap, Angular recovers this state using document.getElementById('ng-state') and parses the content as JSON.This process is susceptible to DOM Clobbering, a technique where an attacker injects an element with a specific ID to override a legitimate DOM element. If an application binds untrusted user input or CMS content to element properties like
id before the genuine script tag is parsed, the attacker-controlled element takes precedence. This allows an attacker to inject a custom JSON payload into the TransferState cache, specifically poisoning the HTTP Transfer Cache. Consequently, HttpClient may return a forged response instead of requesting the genuine backend API, potentially leading to DOM-based Cross-Site Scripting (XSS), privilege escalation by spoofing user info, or UI hijacking.Recommendations
Update to version 22.0.1.
Update to version 21.2.17.
Update to version 20.3.25.
Avoid binding raw user-supplied values or dynamic CMS IDs directly to element attributes; sanitize them or prepend a static safe prefix.
Configure a unique, non-predictable
APP ID in the application configuration to change the state element lookup ID from ng-state to a custom value.Exploit
Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Angular