Technical impact
Angular’s hydration feature serializes a runtime state blob into a <script> element whose id is the predictable string ‘ng-state’. During client bootstrap Angular calls document.getElementById('ng-state') and expects a JSON payload. The lookup method relies only on a fixed element id, making it vulnerable to DOM clobbering when an attacker can insert or bind an element with that id before the legitimate script loads. Because Angular then parses the attacker‑controlled content as JSON, a crafted payload can execute arbitrary scripts or corrupt the application’s state, resulting in client‑side code execution or defacement. The weakness involves improper input validation, insecure handling of DOM identifiers, and unsafe parsing, corresponding to CWE‑471, CWE‑79, and CWE‑807.
Affected Systems
Angular applications built with versions earlier than 22.0.1, 21.2.17, or 20.3.25 that use the provideClientHydration() API for server‑side rendering are affected. Any site that renders user‑supplied or CDN‑served markup before the hydration script and binds that data to element identifiers may be susceptible.
Risk and Exploitability
The CVSS score of 8.6 classifies the flaw as high severity, but the EPSS score of <1% indicates that exploitation probability is very low as of this analysis and the flaw is not listed in the CISA KEV catalog. Exploitation requires an attacker to insert an element with id='ng-state' into the page before Angular’s hydration script runs, typically via an XSS vector or a manipulated CMS template. When successful, the attacker can trigger client‑side code execution or data tampering. Because the vulnerability hinges on client‑side data binding, environments that sanitize or tightly control DOM identifiers face lower risk, yet no known public exploits have been observed.
Github GHSA