GHSA-j58c-ww9w-pwp5 CVE-2025-0716
AngularJS improperly sanitizes SVG elements
- Severity
- 0.0 / 10
- Medium · CVSS 4.0
- Exploit chance (EPSS)
- 0.41%
- Chance of exploitation in the next 30 days. Higher than 35.51% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-791 Incomplete Filtering of Special Elements
- Fix
- None yet
- No fixed version published
Description
Improper sanitization of the value of the 'href' and 'xlink:href' attributes in '<image>' SVG elements in AngularJS allows attackers to bypass common image source restrictions. This can lead to a form of Content Spoofing https://owasp.org/www-community/attacks/Content_Spoofing and also negatively affect the application's performance and behavior by using too large or slow-to-load images.
This issue affects all versions of AngularJS.
Note: The AngularJS project is End-of-Life and will not receive any updates to address this issue. For more information see here https://docs.angularjs.org/misc/version-support-status .
Affected versions
npm
| Package | Vulnerable | Fixed in |
|---|---|---|
| angular | <= 1.8.3 |
No fix yet |
How to fix
No fixed version has been published yet. Until one is, remove or replace the package, or turn off or isolate the affected feature. This page updates when a fix ships.
Severity breakdown
CVSS 4.0 0.0
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
- Attack vector
- Network
- Attack complexity
- High
- Attack requirements
- Present
- Privileges required
- None
- User interaction
- None
- Confidentiality (vulnerable system)
- None
- Integrity (vulnerable system)
- Low
- Availability (vulnerable system)
- Low
- Confidentiality (subsequent systems)
- None
- Integrity (subsequent systems)
- None
- Availability (subsequent systems)
- None
- Exploit maturity
- Proof of concept
CVSS 3.1 4.8
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L
- Attack vector
- Network
- Attack complexity
- High
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- Low
- Availability
- Low
Weakness
CWE-791: Incomplete Filtering of Special Elements
The product receives data from an upstream component, but does not completely filter special elements before sending it to a downstream component.
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-7x27-g8rg-x87w Angular's deprecated package has a Cross-Site Scripting issue | High | Also affects angular |
| GHSA-mqm9-c95h-x2p6 AngularJS allows attackers to bypass common image source restrictions | Medium | Also affects angular |
| GHSA-m9gf-397r-hwpg AngularJS allows attackers to bypass common image source restrictions | Medium | Also affects angular |
| GHSA-4w4v-5hc9-xrr2 angular vulnerable to super-linear runtime due to backtracking | High | Also affects angular |
| GHSA-qwqh-hm9m-p5hr angular vulnerable to regular expression denial of service via the <input type="url"> element | Medium | Also affects angular |
| GHSA-2qqx-w9hr-q5gx angular vulnerable to regular expression denial of service via the $resource service | Medium | Also affects angular |
| GHSA-2vrf-hf26-jrp5 angular vulnerable to regular expression denial of service via the angular.copy() utility | Medium | Also affects angular |
| GHSA-prc3-vjfx-vhm9 Angular (deprecated package) Cross-site Scripting | Medium | Also affects angular |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor