CVE-2025-2336mediumCWE-791

CVE-2025-2336: fallo de gravedad media en Google AngularJS

AngularJS improper sanitization in SVG '<image>' element with 'ngSanitize'

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear AngularJS+ Monitorear angular.js

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 4.8epss 0.3%
Improper sanitization of the value of the 'href' and 'xlink:href' attributes in '<image>' SVG elements in AngularJS's 'ngSanitize' module allows attackers to bypass common image source restrictions. This can lead to a form of Content Spoofing https://owasp.org/www-community/attacks/Content_Spoofing  and also negatively affect the application's performance and behavior by using too large or slow-to-load images. This issue affects AngularJS versions greater than or equal to 1.3.1. Note: The AngularJS project is End-of-Life and will not receive any updates to address this issue. For more information see here https://docs.angularjs.org/misc/version-support-status .
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L
Productos afectados
Google · AngularJS
CVEs relacionadas — Google AngularJS

En el mismo producto, de las más peligrosas a las menos.

CVE-2024-8373MEDIUMAngularJS improper sanitization in '<source>' elementEPSS 0.6%CVE-2024-8372MEDIUMAngularJS improper sanitization in 'srcset' attributeEPSS 0.6%CVE-2025-0716MEDIUMAngularJS improper sanitization in SVG '<image>' elementEPSS 0.4%CVE-2026-11998HIGHAngularJS XSS via SCE resource URL sanitization bypassEPSS 0.4%CVE-2025-4690MEDIUMAngularJS 'linky' filter ReDoSEPSS 0.2%