CVE-2026-54267

A flaw was found in the Angular framework's client-side hydration feature for Server-Side Rendered (SSR) applications. This vulnerability, known as DOM Clobbering, allows a remote attacker to inject malicious data into the application's internal data cache. By exploiting a predictable identifier used to recover application state, an attacker can trick Angular into processing their controlled content instead of the legitimate one. This can lead to poisoning the HTTP Transfer Cache, potentially resulting in Cross-Site Scripting (XSS), where attackers can execute unauthorized code in a user's browser, privilege escalation, or user interface hijacking.

Red Hat products do not ship an @angular/core version within the vulnerable range (>= 22.0.0-next.0, < 22.0.1). Additionally, no Red Hat product ships or uses Angular's Server-Side Rendering hydration feature (@angular/platform-server, @angular/ssr, provideClientHydration()) that this vulnerability depends on. Existing Angular usage in Red Hat's portfolio (Red Hat Advanced Cluster Management's volsync UI, Red Hat Integration Service Registry UI) uses versions outside the vulnerable range and does not implement client hydration with untrusted input bound to DOM element IDs.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.