« Volver al listado

CVE-2025-59052

Estado: AplazadaAlta (7.1)—

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Angular uses a DI container (the "platform injector") to hold request-specific state during server-side rendering. For historical reasons, the container was stored as a JavaScript module-scoped global variable. When multiple requests are processed concurrently, they could inadvertently share or overwrite the global injector state.

Leer descripción completaMostrar menos

In practical terms, this can lead to one request responding with data meant for a completely different request, leaking data or tokens included on the rendered page or in response headers. As long as an attacker had network access to send any traffic that received a rendered response, they may have been able to send a large number of requests and then inspect the responses for information leaks. The APIs `bootstrapApplication`, `getPlatform`, and `destroyPlatform` were vulnerable and required SSR-only breaking changes. The issue has been patched in all active release lines as well as in the v21 prerelease. Patched packages include `@angular/platform-server` 21.0.0-next.3, 20.3.0, 19.2.15, and 18.2.14 and `@angular/ssr` 21.0.0-next.3, 20.3.0, 19.2.16, and 18.2.21. Several workarounds are available. Disable SSR via Server Routes or builder options, remove any asynchronous behavior from custom `bootstrap` functions, remove uses of `getPlatform()` in application code, and/or ensure that the server build defines `ngJitMode` as false.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Requiere interacción del usuario (UI:P) y afecta SSR. La vulnerabilidad filtra datos/tokens de otras solicitudes mediante condiciones de carrera en el contenedor DI global; no requiere acceso local ni escalada de privilegios, sino lectura de información sensible en respuestas renderizadas.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Update SoftwareActive Directory ConfigurationUser TrainingRestrict File and Directory PermissionsPrivileged Account ManagementPassword Policies

Tecnologías afectadas (2)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Angular — Platform ServerAIAngular — SSRAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-59052",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-59052",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-09-10T20:24:52.001731Z"
        }
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "Safety": "NOT_DEFINED",
          "version": "4.0",
          "Recovery": "NOT_DEFINED",
          "baseScore": 7.1,
          "Automatable": "NOT_DEFINED",
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "exploitMaturity": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED",
          "userInteraction": "PASSIVE",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "NONE",
          "subIntegrityImpact": "NONE",
          "vulnIntegrityImpact": "LOW",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "vulnAvailabilityImpact": "NONE",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "NONE",
          "vulnConfidentialityImpact": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "angular",
          "product": "angular",
          "versions": [
            {
              "status": "affected",
              "version": "@angular/platform-server >= 16.0.0-next.0, < 18.2.14"
            },
            {
              "status": "affected",
              "version": "@angular/platform-server >= 20.0.0-next.0, < 20.3.0"
            },
            {
              "status": "affected",
              "version": "@angular/platform-server >= 19.0.0-next.0, < 19.2.15"
            },
            {
              "status": "affected",
              "version": "@angular/platform-server >= 21.0.0-next.0, < 21.0.0-next.3"
            },
            {
              "status": "affected",
              "version": "@angular/ssr >= 17.0.0-next.0, < 18.2.21"
            },
            {
              "status": "affected",
              "version": "@angular/ssr >= 19.0.0-next.0, < 19.2.16"
            },
            {
              "status": "affected",
              "version": "@angular/ssr >= 20.0.0-next.0, < 20.3.0"
            },
            {
              "status": "affected",
              "version": "@angular/ssr >= 21.0.0-next.0, < 21.0.0-next.3"
            },
            {
              "status": "affected",
              "version": "@nguniversal/common >= 16.0.0-next.0, <= 16.2.0"
            }
          ]
        }
      ]
    }
  ],
  "published": "2025-09-10T21:15:37.283",
  "references": [
    {
      "url": "https://github.com/angular/angular-cli/pull/31108",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/angular/angular/pull/63562",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/angular/angular/security/advisories/GHSA-68x2-mx4q-78m7",
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-362"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Angular uses a DI container (the \"platform injector\") to hold request-specific state during server-side rendering. For historical reasons, the container was stored as a JavaScript module-scoped global variable. When multiple requests are processed concurrently, they could inadvertently share or overwrite the global injector state. In practical terms, this can lead to one request responding with data meant for a completely different request, leaking data or tokens included on the rendered page or in response headers. As long as an attacker had network access to send any traffic that received a rendered response, they may have been able to send a large number of requests and then inspect the responses for information leaks. The APIs `bootstrapApplication`, `getPlatform`, and `destroyPlatform` were vulnerable and required SSR-only breaking changes.\nThe issue has been patched in all active release lines as well as in the v21 prerelease. Patched packages include `@angular/platform-server` 21.0.0-next.3, 20.3.0, 19.2.15, and 18.2.14 and `@angular/ssr` 21.0.0-next.3, 20.3.0, 19.2.16, and 18.2.21. Several workarounds are available. Disable SSR via Server Routes or builder options, remove any asynchronous behavior from custom `bootstrap` functions, remove uses of `getPlatform()` in application code, and/or ensure that the server build defines `ngJitMode` as false."
    },
    {
      "lang": "es",
      "value": "Angular es una plataforma de desarrollo para construir aplicaciones web móviles y de escritorio usando TypeScript/JavaScript y otros lenguajes. Angular usa un contenedor DI (el 'inyector de plataforma') para mantener el estado específico de la solicitud durante la renderización del lado del servidor. Por razones históricas, el contenedor se almacenaba como una variable global con alcance de módulo de JavaScript. Cuando se procesan múltiples solicitudes concurrentemente, estas podrían compartir o sobrescribir inadvertidamente el estado global del inyector. En términos prácticos, esto puede llevar a que una solicitud responda con datos destinados a una solicitud completamente diferente, filtrando datos o tokens incluidos en la página renderizada o en los encabezados de respuesta. Mientras un atacante tuviera acceso a la red para enviar cualquier tráfico que recibiera una respuesta renderizada, podría haber sido capaz de enviar un gran número de solicitudes y luego inspeccionar las respuestas en busca de fugas de información. Las APIs 'bootstrapApplication', 'getPlatform' y 'destroyPlatform' eran vulnerables y requerían cambios disruptivos solo para SSR.\nEl problema ha sido parcheado en todas las líneas de lanzamiento activas, así como en la versión preliminar v21. Los paquetes parcheados incluyen '@angular/platform-server' 21.0.0-next.3, 20.3.0, 19.2.15 y 18.2.14 y '@angular/ssr' 21.0.0-next.3, 20.3.0, 19.2.16 y 18.2.21. Varias soluciones alternativas están disponibles. Deshabilite SSR a través de Rutas del Servidor u opciones del constructor, elimine cualquier comportamiento asíncrono de las funciones 'bootstrap' personalizadas, elimine los usos de 'getPlatform()' en el código de la aplicación, y/o asegúrese de que la compilación del servidor defina 'ngJitMode' como falso."
    }
  ],
  "lastModified": "2026-06-17T09:45:30.480",
  "sourceIdentifier": "security-advisories@github.com"
}