A vulnerability described as problematic has been identified in Angular up to 19.2.25. Affected is the function
provideClientHydration. Such manipulation leads to cross site scripting.
This vulnerability is traded as CVE-2026-54267. The attack may be launched remotely. There is no exploit available.
Upgrading the affected component is recommended.
