CVE-2025-2336: AngularJS Incomplete Filtering of Special Elements vulnerability
(updated )
Improper sanitization of the value of the ‘href’ and ‘xlink:href’ attributes in ‘’ SVG elements in AngularJS’s ’ngSanitize’ module allows attackers to bypass common image source restrictions. This can lead to a form of Content Spoofing https://owasp.org/www-community/attacks/Content_Spoofing and also negatively affect the application’s performance and behavior by using too large or slow-to-load images.
This issue affects AngularJS versions greater than or equal to 1.3.1.
Note: The AngularJS project is End-of-Life and will not receive any updates to address this issue. For more information see here https://docs.angularjs.org/misc/version-support-status .
References
- codepen.io/herodevs/pen/bNGYaXx/412a3a4218387479898912f60c269c6c
- github.com/advisories/GHSA-4p4w-6hg8-63wx
- github.com/angular/angular.js
- lists.debian.org/debian-lts-announce/2025/07/msg00005.html
- nvd.nist.gov/vuln/detail/CVE-2025-2336
- www.herodevs.com/vulnerability-directory/cve-2025-2336
- www.herodevs.com/vulnerability-directory/cve-2025-2336?angularjs-nes
Code Behaviors & Features
Detect and mitigate CVE-2025-2336 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →