CVE-2025-4690mediumCWE-1333

CVE-2025-4690: fallo de gravedad media en Google AngularJS

AngularJS 'linky' filter ReDoS

Publicada el

Seguir esta CVE+ Monitorear AngularJS+ Monitorear angular.js

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 4.3epss 0.2%
A regular expression used by AngularJS'  linky https://docs.angularjs.org/api/ngSanitize/filter/linky  filter to detect URLs in input text is vulnerable to super-linear runtime due to backtracking. With a large carefully-crafted input, this can cause a Regular expression Denial of Service (ReDoS) https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS  attack on the application. This issue affects all versions of AngularJS. Note: The AngularJS project is End-of-Life and will not receive any updates to address this issue. For more information see here https://docs.angularjs.org/misc/version-support-status .
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Productos afectados
Google · AngularJS
CVEs relacionadas — Google AngularJS

En el mismo producto, de las más peligrosas a las menos.

CVE-2024-8373MEDIUMAngularJS improper sanitization in '<source>' elementEPSS 0.6%CVE-2024-8372MEDIUMAngularJS improper sanitization in 'srcset' attributeEPSS 0.6%CVE-2025-0716MEDIUMAngularJS improper sanitization in SVG '<image>' elementEPSS 0.4%CVE-2026-11998HIGHAngularJS XSS via SCE resource URL sanitization bypassEPSS 0.4%CVE-2025-2336MEDIUMAngularJS improper sanitization in SVG '<image>' element with 'ngSanitize'EPSS 0.3%