Junglewise Threat Intelligence

CVE-2025-2336: AngularJS ngSanitize SVG image source restriction bypass

CVE-2025-2336 · Severity: low · CVSS 3.1 · Published 2025-06-04

Vendors: Google, npm.

Executive brief

AngularJS is a popular JavaScript framework widely used in web applications. Its ngSanitize module is designed to filter potentially dangerous HTML code and enforce security policies like restricting images to trusted domains. This vulnerability in the filtering logic allows attackers to circumvent these image source restrictions by exploiting SVG elements, potentially displaying fake or malicious content to users or degrading application performance with resource-intensive images. Since AngularJS reached end-of-life, no official security patches will be released.

Technical details

The vulnerability is an improper input sanitization flaw (CWE-791) in AngularJS's ngSanitize module affecting versions ≥1.3.1 (last affected 1.8.3). The $sanitize service fails to correctly detect and validate SVG <image> elements with href or xlink:href attributes, even when SVG support is explicitly enabled via $sanitizeProvider.enableSvg(). As a result, configured image source restrictions (set via $compileProvider.imgSrcSanitizationTrustedUrlList()) are not applied to images loaded from SVG elements, allowing an attacker to inject image references to untrusted domains. The attack requires no authentication or user interaction beyond the application processing attacker-controlled SVG markup. The $sanitize service is also used internally by ngBindHtml and the linky filter, extending the attack surface. No official patch is available; HeroDevs offers a paid Never-Ending Support (NES) fork with fixes in versions 1.4.16, 1.5.25, and 1.9.9.

Affected products

  • Google AngularJS >=1.3.1, <=1.8.3
  • Google angular-sanitize >=1.3.1, <=1.8.3

Timeline

  • 2025-06-04: disclosed: Vulnerability published in advisory database
  • 2025-06-04: advisory: GHSA-4p4w-6hg8-63wx and CVE-2025-2336 advisory released
  • 2025-07-20: patched: Debian LTS security update DLA-4242-1 released (no official upstream patch; AngularJS is EOL since April 2024)

References