CVE-2025-2336

Name of the Vulnerable Software and Affected Versions AngularJS versions 1.3.1 and later

Description The issue is related to improper sanitization of the href and xlink:href attributes in <image> SVG elements in the ngSanitize module. This allows attackers to bypass common image source restrictions, potentially leading to Content Spoofing and negatively affecting the application's performance and behavior by using large or slow-to-load images.

Recommendations For AngularJS versions 1.3.1 and later, consider disabling the ngSanitize module or restricting the use of <image> SVG elements until a workaround can be implemented, noting that the AngularJS project is End-of-Life and will not receive updates to address this issue.