PT-2025-23829 · Google+3 · Angularjs+3

George Kalpakas · Published 2025-06-04 · Updated 2026-01-14 · CVE-2025-2336

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions AngularJS versions 1.3.1 and later

Description The issue is related to improper sanitization of the href and xlink:href attributes in <image> SVG elements in the ngSanitize module. This allows attackers to bypass common image source restrictions, potentially leading to Content Spoofing and negatively affecting the application's performance and behavior by using large or slow-to-load images.

Recommendations For AngularJS versions 1.3.1 and later, consider disabling the ngSanitize module or restricting the use of <image> SVG elements until a workaround can be implemented, noting that the AngularJS project is End-of-Life and will not receive updates to address this issue.

Exploit

Fix

Weakness Enumeration

CWE-791

Related Identifiers

CVE-2025-2336

DLA-4242-1

GHSA-4P4W-6HG8-63WX

USN-7958-1

Affected Products

Angularjs

Debian

Linuxmint

Ubuntu

References · 27

• 🔥 https://herodevs.com/vulnerability-directory/cve-2025-2336?angularjs-nes · Exploit
• 🔥 https://codepen.io/herodevs/pen/bNGYaXx/412a3a4218387479898912f60c269c6c · Exploit
• https://ubuntu.com/security/CVE-2025-0716 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-2336 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-21490 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-25844 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-7958-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-2336 · Vendor Advisory
• https://osv.dev/vulnerability/USN-7958-1 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-4242-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-26118 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-2336 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-2336 · Security Note
• https://osv.dev/vulnerability/GHSA-4p4w-6hg8-63wx · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-26116 · Vendor Advisory