DOM Clobbering Vulnerability in Angular Framework
CVE-2026-54267
What is CVE-2026-54267?
Angular is a platform designed for crafting mobile and desktop web applications using TypeScript and JavaScript. The framework features 'Hydration' support for optimizing client-side bootstrap in Server-Side Rendered (SSR) environments. Prior to version 22.0.1, Angular inadvertently exposed a vulnerability allowing for DOM Clobbering due to predictable ID selectors. During hydration, when an application utilizes untrusted user input or content management system (CMS) content to assign an ID to an element, an attacker could replace the expected state container. This results in Angular calling document.getElementById('ng-state') and overpowering the correct element, leading to the potential parsing of malicious or manipulated content. The issue has been addressed in Angular versions 22.0.1, 21.2.17, and 20.3.25, ensuring improved security against such attacks.
Affected Version(s)
angular >= 22.0.0-next.0 < 22.0.1 < 22.0.0-next.0 22.0.1
angular >= 21.0.0-next.0 < 21.2.17 < 21.0.0-next.0 21.2.17
angular >= 20.0.0-next.0 < 20.3.25 < 20.0.0-next.0 20.3.25