Executive brief
AngularJS, a popular JavaScript framework for building web applications, fails to properly sanitize SVG image elements. An attacker can exploit this to bypass image source restrictions and perform content spoofing attacks, or degrade application performance by injecting large or slow-loading images. This affects all versions of AngularJS, which is no longer receiving updates.
Technical details
The vulnerability stems from improper sanitization of the 'href' and 'xlink:href' attributes in SVG <image> elements within AngularJS. An attacker can craft malicious SVG elements to bypass common image source validation controls and inject arbitrary image sources. This is a CWE-791 (Incorrect Filtering of Special Elements or Attributes) issue. The attack vector is network-based and requires no authentication or user interaction beyond viewing a page containing the malicious SVG. Exploitation can result in content spoofing attacks or performance degradation. Since AngularJS is end-of-life, no patch will be released.
Affected products
- Google AngularJS all versions up to and including 1.8.3
Timeline
- 2025-04-29: disclosed
- 2025-04-30: advisory