In short
- CVE-2025-0716 is a MEDIUM (CVSS 4.8) vulnerability affecting angular.
- Chance of exploitation in the next 30 days (EPSS): 0.41%, higher than 35.5% of all vulnerabilities.
- No patched version is listed yet: follow the vendor's advisory in References.
| Package | Affected versions | Patched versions |
|---|
| angular npm | ≤ 1.8.3
| No fix yet |
Description
Improper sanitization of the value of the 'href' and 'xlink:href' attributes in '<image>' SVG elements in AngularJS allows attackers to bypass common image source restrictions. This can lead to a form of Content Spoofing https://owasp.org/www-community/attacks/Content_Spoofing and also negatively affect the application's performance and behavior by using too large or slow-to-load images.
This issue affects all versions of AngularJS.
Note:
The AngularJS project is End-of-Life and will not receive any updates to address this issue. For more information see here https://docs.angularjs.org/misc/version-support-status .
NVD description
Improper sanitization of the value of the 'href' and 'xlink:href' attributes in '<image>' SVG elements in AngularJS allows attackers to bypass common image source restrictions. This can lead to a form of Content Spoofing https://owasp.org/www-community/attacks/Content_Spoofing and also negatively affect the application's performance and behavior by using too large or slow-to-load images.
This issue affects all versions of AngularJS.
Note:
The AngularJS project is End-of-Life and will not receive any updates to address this issue. For more information see here https://docs.angularjs.org/misc/version-support-status .
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free