{"id":"CVE-2025-2336","aliases":["CLSA-2026-1773706637","CLSA-2026-1773793040","CLSA-2026-1773965926","CLSA-2026-1774052346","CLSA-2026-1774052360","CLSA-2026-1775694723","CLSA-2026-1775694727","CLSA-2026-1775694728","CLSA-2026-1781657704","CLSA-2026-1785381052","CLSA-2026-1786355374","DEBIAN-CVE-2025-2336","DLA-4242-1","EUVD-2025-16899","GHSA-4p4w-6hg8-63wx","ROOT-APP-NPM-CVE-2025-2336","UBUNTU-CVE-2025-2336"],"status":"published","title":"AngularJS improper sanitization in SVG '\u003cimage\u003e' element with 'ngSanitize'","description":"Improper sanitization of the value of the 'href' and 'xlink:href' attributes in '\u003cimage\u003e' SVG elements in AngularJS's 'ngSanitize' module allows attackers to bypass common image source restrictions. This can lead to a form of  Content Spoofing https://owasp.org/www-community/attacks/Content_Spoofing  and also negatively affect the application's performance and behavior by using too large or slow-to-load images.\n\nThis issue affects AngularJS versions greater than or equal to 1.3.1.\n\nNote:\nThe AngularJS project is End-of-Life and will not receive any updates to address this issue. For more information see  here https://docs.angularjs.org/misc/version-support-status .","severity":{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00311,"percentile":0.24138,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-791"],"published":"2025-06-04T16:32:31Z","modified":"2026-10-28T02:30:50Z","fixes":[{"ecosystem":"TuxCare:npm","package":"angular-sanitize","fixed_in":["1.8.2-tuxcare.1","1.8.3-tuxcare.1","1.5.5-tuxcare.1","1.5.11-tuxcare.1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"angular.js","fixed_in":["1.8.3-1+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"angular.js","fixed_in":["1.8.3-2"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/angular-sanitize","fixed_in":["1.8.3-root.io.1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"angular-sanitize","fixed_in":["1.8.3-aikido.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"angular.js","fixed_in":["1.5.10-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"angular.js","fixed_in":["1.7.9-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"angular.js","fixed_in":["1.8.2-2ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"angular.js","fixed_in":["1.8.3-1ubuntu0.24.04.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"angular-sanitize","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.3.1"},{"last_affected":"1.8.3"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"angular","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.8.2-tuxcare.0"},{"fixed":"1.8.2-tuxcare.1"}]}],"versions":["1.8.2"],"bundled":11},{"source":"osv","ecosystem":"TuxCare:npm","package":"angular","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.6.10-tuxcare.0"},{"fixed":"1.6.10-tuxcare.1"}]}],"versions":["1.6.10"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:npm","package":"angular","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.8.3-tuxcare.0"},{"fixed":"1.8.3-tuxcare.1"}]}],"versions":["1.8.3"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:npm","package":"angular","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7.9-tuxcare.0"},{"fixed":"1.7.9-tuxcare.3"}]}],"versions":["1.7.9","1.7.9-tuxcare.1","1.7.9-tuxcare.2"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"angular","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.5.11-tuxcare.0"},{"fixed":"1.5.11-tuxcare.4"}]}],"versions":["1.5.11","1.5.11-tuxcare.1","1.5.11-tuxcare.2","1.5.11-tuxcare.3"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"angular-sanitize","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.8.2-tuxcare.0"},{"fixed":"1.8.2-tuxcare.1"}]}],"versions":["1.8.2"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"angular-sanitize","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.8.3-tuxcare.0"},{"fixed":"1.8.3-tuxcare.1"}]}],"versions":["1.8.3"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"angular-sanitize","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.6.10-tuxcare.0"},{"fixed":"1.6.10-tuxcare.1"}]}],"versions":["1.6.10"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"angular-sanitize","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.5.5-tuxcare.0"},{"fixed":"1.5.5-tuxcare.1"}]}],"versions":["1.5.5"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"angular","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.5.10-tuxcare.0"},{"fixed":"1.5.10-tuxcare.3"}]}],"versions":["1.5.10","1.5.10-tuxcare.1","1.5.10-tuxcare.2"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"angular-sanitize","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.5.11-tuxcare.0"},{"fixed":"1.5.11-tuxcare.1"}]}],"versions":["1.5.11"]},{"source":"osv","ecosystem":"Debian:12","package":"angular.js","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.3-1+deb12u1"}]}],"versions":["1.8.3-1","1.8.3-1+deb12u1~deb11u1"]},{"source":"osv","ecosystem":"Debian:13","package":"angular.js","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.3-2"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"angular.js","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.3-1+deb12u1~deb11u1"}]}],"versions":["1.8.2-2","1.8.3-1"],"bundled":9},{"source":"osv","ecosystem":"npm","package":"angular-sanitize","ranges":[{"type":"SEMVER","events":[{"introduced":"1.3.1"},{"last_affected":"1.8.3"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/angular-sanitize","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.3-root.io.1"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"angular-sanitize","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.3-aikido.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"angular.js","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.10-1ubuntu0.1~esm1"}]}],"versions":["1.5.10-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"angular.js","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.9-1ubuntu0.1~esm1"}]}],"versions":["1.5.10-1","1.7.9-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"angular.js","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.2-2ubuntu0.1"}]}],"versions":["1.8.2-2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"angular.js","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.3-1ubuntu0.24.04.1"}]}],"versions":["1.8.3-1"]}],"products":[{"vendor":"google","product":"angularjs"}],"references":[{"url":"https://www.herodevs.com/vulnerability-directory/cve-2025-2336","tags":["third-party-advisory","advisory","web","report"]},{"url":"https://codepen.io/herodevs/pen/bNGYaXx/412a3a4218387479898912f60c269c6c","tags":["technical-description","exploit","evidence","web","report"]},{"url":"https://www.herodevs.com/vulnerability-directory/cve-2025-2336?angularjs-nes","tags":["exploit","evidence","web","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2025/07/msg00005.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-2336","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-4p4w-6hg8-63wx"},{"url":"https://registry.npmjs.org","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/2xxx/CVE-2025-2336.json","tags":["advisory"]},{"url":"https://github.com/angular/angular.js","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-2336","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-2336","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-2336","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7958-1","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-2336","title":"AngularJS improper sanitization in SVG '\u003cimage\u003e' element with 'ngSanitize'","description":"Improper sanitization of the value of the 'href' and 'xlink:href' attributes in '\u003cimage\u003e' SVG elements in AngularJS's 'ngSanitize' module allows attackers to bypass common image source restrictions. This can lead to a form of  Content Spoofing https://owasp.org/www-community/attacks/Content_Spoofing  and also negatively affect the application's performance and behavior by using too large or slow-to-load images.\n\nThis issue affects AngularJS versions greater than or equal to 1.3.1.\n\nNote:\nThe AngularJS project is End-of-Life and will not receive any updates to address this issue. For more information see  here https://docs.angularjs.org/misc/version-support-status .","status":"published","published":"2025-06-04T16:32:31.665Z","modified":"2025-11-03T19:43:05.229Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-791"],"updated_at":"2026-11-02T14:32:38.70481Z"}],"euvd":[{"id":"EUVD-2025-16899","description":"Improper sanitization of the value of the 'href' and 'xlink:href' attributes in '\u003cimage\u003e' SVG elements in AngularJS's 'ngSanitize' module allows attackers to bypass common image source restrictions. This can lead to a form of  Content Spoofing https://owasp.org/www-community/attacks/Content_Spoofing  and also negatively affect the application's performance and behavior by using too large or slow-to-load images.\n\nThis issue affects AngularJS versions greater than or equal to 1.3.1.\n\nNote:\nThe AngularJS project is End-of-Life and will not receive any updates to address this issue. For more information see  here https://docs.angularjs.org/misc/version-support-status .","status":"published","published":"2025-06-04T16:32:31Z","modified":"2025-11-03T19:43:05Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T19:49:33.639996Z"}],"ghsa":[{"id":"GHSA-4p4w-6hg8-63wx","title":"AngularJS Incomplete Filtering of Special Elements vulnerability","description":"Improper sanitization of the value of the 'href' and 'xlink:href' attributes in '\u003cimage\u003e' SVG elements in AngularJS's 'ngSanitize' module allows attackers to bypass common image source restrictions. This can lead to a form of  Content Spoofing https://owasp.org/www-community/attacks/Content_Spoofing  and also negatively affect the application's performance and behavior by using too large or slow-to-load images.\n\nThis issue affects AngularJS versions greater than or equal to 1.3.1.\n\nNote:\nThe AngularJS project is End-of-Life and will not receive any updates to address this issue. For more information see  here https://docs.angularjs.org/misc/version-support-status .","status":"published","published":"2025-06-04T18:30:58Z","modified":"2025-11-03T21:35:04Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"cwes":["CWE-791"],"updated_at":"2026-11-02T14:39:05.278442Z"}],"nvd":[{"id":"CVE-2025-2336","description":"Improper sanitization of the value of the 'href' and 'xlink:href' attributes in '\u003cimage\u003e' SVG elements in AngularJS's 'ngSanitize' module allows attackers to bypass common image source restrictions. This can lead to a form of  Content Spoofing https://owasp.org/www-community/attacks/Content_Spoofing  and also negatively affect the application's performance and behavior by using too large or slow-to-load images.\n\nThis issue affects AngularJS versions greater than or equal to 1.3.1.\n\nNote:\nThe AngularJS project is End-of-Life and will not receive any updates to address this issue. For more information see  here https://docs.angularjs.org/misc/version-support-status .","status":"published","published":"2025-06-04T17:15:28.643Z","modified":"2026-06-17T09:06:46.73Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-791"],"updated_at":"2026-11-02T14:11:10.8732Z"}],"osv":[{"id":"CVE-2025-2336","title":"AngularJS improper sanitization in SVG '\u003cimage\u003e' element with 'ngSanitize'","description":"Improper sanitization of the value of the 'href' and 'xlink:href' attributes in '\u003cimage\u003e' SVG elements in AngularJS's 'ngSanitize' module allows attackers to bypass common image source restrictions. This can lead to a form of  Content Spoofing https://owasp.org/www-community/attacks/Content_Spoofing  and also negatively affect the application's performance and behavior by using too large or slow-to-load images.\n\nThis issue affects AngularJS versions greater than or equal to 1.3.1.\n\nNote:\nThe AngularJS project is End-of-Life and will not receive any updates to address this issue. For more information see  here https://docs.angularjs.org/misc/version-support-status .","status":"published","published":"2025-06-04T16:32:31.665Z","modified":"2026-10-28T02:30:50.541555742Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"cwes":["CWE-791"],"updated_at":"2026-11-02T15:44:47.009967Z"},{"id":"DEBIAN-CVE-2025-2336","description":"Improper sanitization of the value of the 'href' and 'xlink:href' attributes in '\u003cimage\u003e' SVG elements in AngularJS's 'ngSanitize' module allows attackers to bypass common image source restrictions. This can lead to a form of  Content Spoofing https://owasp.org/www-community/attacks/Content_Spoofing  and also negatively affect the application's performance and behavior by using too large or slow-to-load images.  This issue affects AngularJS versions greater than or equal to 1.3.1.  Note: The AngularJS project is End-of-Life and will not receive any updates to address this issue. For more information see  here https://docs.angularjs.org/misc/version-support-status .","status":"published","published":"2025-06-04T17:15:28.643Z","modified":"2026-09-01T20:05:44.545877839Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:45:45.870237Z"},{"id":"GHSA-4p4w-6hg8-63wx","title":"AngularJS Incomplete Filtering of Special Elements vulnerability","description":"Improper sanitization of the value of the 'href' and 'xlink:href' attributes in '\u003cimage\u003e' SVG elements in AngularJS's 'ngSanitize' module allows attackers to bypass common image source restrictions. This can lead to a form of  Content Spoofing https://owasp.org/www-community/attacks/Content_Spoofing  and also negatively affect the application's performance and behavior by using too large or slow-to-load images.\n\nThis issue affects AngularJS versions greater than or equal to 1.3.1.\n\nNote:\nThe AngularJS project is End-of-Life and will not receive any updates to address this issue. For more information see  here https://docs.angularjs.org/misc/version-support-status .","status":"published","published":"2025-06-04T18:30:58Z","modified":"2025-11-03T21:33:59Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"cwes":["CWE-791"],"updated_at":"2026-11-02T15:46:37.148947Z"},{"id":"UBUNTU-CVE-2025-2336","description":"Improper sanitization of the value of the 'href' and 'xlink:href' attributes in '\u003cimage\u003e' SVG elements in AngularJS's 'ngSanitize' module allows attackers to bypass common image source restrictions. This can lead to a form of  Content Spoofing https://owasp.org/www-community/attacks/Content_Spoofing  and also negatively affect the application's performance and behavior by using too large or slow-to-load images. This issue affects AngularJS versions greater than or equal to 1.3.1. Note: The AngularJS project is End-of-Life and will not receive any updates to address this issue. For more information see  here https://docs.angularjs.org/misc/version-support-status .","status":"published","published":"2025-06-04T17:15:00Z","modified":"2026-02-04T03:17:26.224034Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T16:55:26.330196Z"},{"id":"CLSA-2026-1773706637","title":"TuxCare security update for angular (11 CVEs)","description":"TuxCare rebuilt angular to address 11 CVEs. Fixed in 1.8.2-tuxcare.1.","status":"published","published":"2026-08-04T14:52:13Z","modified":"2026-10-15T09:47:46.685142674Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1773793040","title":"TuxCare security update for angular (9 CVEs)","description":"TuxCare rebuilt angular to address 9 CVEs. Fixed in 1.6.10-tuxcare.1.","status":"published","published":"2026-08-04T14:52:13Z","modified":"2026-10-15T09:47:47.16136228Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1773965926","title":"TuxCare security update for angular (8 CVEs)","description":"TuxCare rebuilt angular to address 8 CVEs. Fixed in 1.8.3-tuxcare.1.","status":"published","published":"2026-08-04T14:52:13Z","modified":"2026-10-15T09:47:01.480966302Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1774052346","title":"TuxCare security update for angular (2 CVEs)","description":"TuxCare rebuilt angular to address 2 CVEs. Fixed in 1.7.9-tuxcare.3.","status":"published","published":"2026-08-04T14:52:13Z","modified":"2026-10-15T09:47:00.924090733Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1774052360","title":"TuxCare security update for angular (3 CVEs)","description":"TuxCare rebuilt angular to address 3 CVEs. Fixed in 1.5.11-tuxcare.4.","status":"published","published":"2026-08-04T14:52:14Z","modified":"2026-10-15T09:47:01.483511208Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1775694723","title":"TuxCare security update for angular-sanitize (1 CVE)","description":"TuxCare rebuilt angular-sanitize to address 1 CVE. Fixed in 1.8.2-tuxcare.1.","status":"published","published":"2026-08-04T14:52:23Z","modified":"2026-10-15T09:46:37.567228261Z","updated_at":"2026-11-02T15:43:44.009773Z"},{"id":"CLSA-2026-1775694727","title":"TuxCare security update for angular-sanitize (1 CVE)","description":"TuxCare rebuilt angular-sanitize to address 1 CVE. Fixed in 1.8.3-tuxcare.1.","status":"published","published":"2026-08-04T14:52:23Z","modified":"2026-10-15T09:46:36.808619043Z","updated_at":"2026-11-02T15:43:44.009773Z"},{"id":"CLSA-2026-1775694728","title":"TuxCare security update for angular-sanitize (2 CVEs)","description":"TuxCare rebuilt angular-sanitize to address 2 CVEs. Fixed in 1.6.10-tuxcare.1.","status":"published","published":"2026-08-04T14:52:23Z","modified":"2026-10-15T09:46:36.199139502Z","updated_at":"2026-11-02T15:43:44.009773Z"},{"id":"CLSA-2026-1781657704","title":"TuxCare security update for angular-sanitize (1 CVE)","description":"TuxCare rebuilt angular-sanitize to address 1 CVE. Fixed in 1.5.5-tuxcare.1.","status":"published","published":"2026-08-04T14:52:37Z","modified":"2026-10-15T09:45:10.636592392Z","updated_at":"2026-11-02T15:43:45.445699Z"},{"id":"CLSA-2026-1785381052","title":"TuxCare security update for angular (4 CVEs)","description":"TuxCare rebuilt angular to address 4 CVEs. Fixed in 1.5.10-tuxcare.3.","status":"published","published":"2026-08-04T14:52:51Z","modified":"2026-10-15T09:48:03.977091093Z","updated_at":"2026-11-02T15:43:46.850893Z"},{"id":"CLSA-2026-1786355374","title":"TuxCare security update for angular-sanitize (1 CVE)","description":"TuxCare rebuilt angular-sanitize to address 1 CVE. Fixed in 1.5.11-tuxcare.1.","status":"published","published":"2026-08-10T09:49:34Z","modified":"2026-10-15T09:45:57.504019813Z","updated_at":"2026-11-02T15:43:46.850893Z"},{"id":"DLA-4242-1","title":"angular.js - security update","status":"published","published":"2025-07-20T00:00:00Z","modified":"2026-03-09T02:10:45.874056Z","updated_at":"2026-11-02T15:46:12.7027Z"},{"id":"ROOT-APP-NPM-CVE-2025-2336","title":"CVE-2025-2336 in @rootio/angular-sanitize - Patched by Root","description":"Root has patched CVE-2025-2336 in the @rootio/angular-sanitize package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-06-19T07:25:20Z","modified":"2026-06-19T13:45:12.007074025Z","updated_at":"2026-11-02T15:53:27.362922Z"}]}}