CVE-2025-4690mediumCWE-1333

CVE-2025-4690: medium-severity vulnerability in Google AngularJS

AngularJS 'linky' filter ReDoS

Published

Follow this CVE+ Monitor AngularJS+ Monitor angular.js

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 4.3epss 0.2%
A regular expression used by AngularJS'  linky https://docs.angularjs.org/api/ngSanitize/filter/linky  filter to detect URLs in input text is vulnerable to super-linear runtime due to backtracking. With a large carefully-crafted input, this can cause a Regular expression Denial of Service (ReDoS) https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS  attack on the application. This issue affects all versions of AngularJS. Note: The AngularJS project is End-of-Life and will not receive any updates to address this issue. For more information see here https://docs.angularjs.org/misc/version-support-status .
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Affected products
Google · AngularJS
Related CVEs — Google AngularJS

In the same product, most dangerous first.

CVE-2024-8373MEDIUMAngularJS improper sanitization in '<source>' elementEPSS 0.6%CVE-2024-8372MEDIUMAngularJS improper sanitization in 'srcset' attributeEPSS 0.6%CVE-2025-0716MEDIUMAngularJS improper sanitization in SVG '<image>' elementEPSS 0.4%CVE-2026-11998HIGHAngularJS XSS via SCE resource URL sanitization bypassEPSS 0.4%CVE-2025-2336MEDIUMAngularJS improper sanitization in SVG '<image>' element with 'ngSanitize'EPSS 0.3%