Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-s1yh-7m2a-y3g3
Vulnerability ID VCID-s1yh-7m2a-y3g3
Aliases CVE-2025-2336
GHSA-4p4w-6hg8-63wx
Summary AngularJS Incomplete Filtering of Special Elements vulnerability Improper sanitization of the value of the 'href' and 'xlink:href' attributes in '<image>' SVG elements in AngularJS's 'ngSanitize' module allows attackers to bypass common image source restrictions. This can lead to a form of Content Spoofing https://owasp.org/www-community/attacks/Content_Spoofing  and also negatively affect the application's performance and behavior by using too large or slow-to-load images. This issue affects AngularJS versions greater than or equal to 1.3.1. Note: The AngularJS project is End-of-Life and will not receive any updates to address this issue. For more information see here https://docs.angularjs.org/misc/version-support-status .
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-791 Incomplete Filtering of Special Elements
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.00198 https://api.first.org/data/v1/epss?cve=CVE-2025-2336
epss 0.00198 https://api.first.org/data/v1/epss?cve=CVE-2025-2336
epss 0.00198 https://api.first.org/data/v1/epss?cve=CVE-2025-2336
epss 0.00198 https://api.first.org/data/v1/epss?cve=CVE-2025-2336
epss 0.00198 https://api.first.org/data/v1/epss?cve=CVE-2025-2336
epss 0.0023 https://api.first.org/data/v1/epss?cve=CVE-2025-2336
epss 0.0023 https://api.first.org/data/v1/epss?cve=CVE-2025-2336
epss 0.0023 https://api.first.org/data/v1/epss?cve=CVE-2025-2336
epss 0.0023 https://api.first.org/data/v1/epss?cve=CVE-2025-2336
epss 0.0023 https://api.first.org/data/v1/epss?cve=CVE-2025-2336
epss 0.0023 https://api.first.org/data/v1/epss?cve=CVE-2025-2336
epss 0.0023 https://api.first.org/data/v1/epss?cve=CVE-2025-2336
epss 0.0023 https://api.first.org/data/v1/epss?cve=CVE-2025-2336
cvssv3.1 4.8 https://codepen.io/herodevs/pen/bNGYaXx/412a3a4218387479898912f60c269c6c
generic_textual MODERATE https://codepen.io/herodevs/pen/bNGYaXx/412a3a4218387479898912f60c269c6c
ssvc Track https://codepen.io/herodevs/pen/bNGYaXx/412a3a4218387479898912f60c269c6c
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-4p4w-6hg8-63wx
cvssv3.1 4.8 https://github.com/angular/angular.js
generic_textual MODERATE https://github.com/angular/angular.js
cvssv3.1 4.8 https://lists.debian.org/debian-lts-announce/2025/07/msg00005.html
generic_textual MODERATE https://lists.debian.org/debian-lts-announce/2025/07/msg00005.html
cvssv3.1 4.8 https://nvd.nist.gov/vuln/detail/CVE-2025-2336
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2025-2336
cvssv3.1 4.8 https://www.herodevs.com/vulnerability-directory/cve-2025-2336
generic_textual MODERATE https://www.herodevs.com/vulnerability-directory/cve-2025-2336
ssvc Track https://www.herodevs.com/vulnerability-directory/cve-2025-2336
cvssv3.1 4.8 https://www.herodevs.com/vulnerability-directory/cve-2025-2336?angularjs-nes
generic_textual MODERATE https://www.herodevs.com/vulnerability-directory/cve-2025-2336?angularjs-nes
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2025-2336
https://codepen.io/herodevs/pen/bNGYaXx/412a3a4218387479898912f60c269c6c
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-2336
https://github.com/angular/angular.js
https://lists.debian.org/debian-lts-announce/2025/07/msg00005.html
https://nvd.nist.gov/vuln/detail/CVE-2025-2336
https://www.herodevs.com/vulnerability-directory/cve-2025-2336
https://www.herodevs.com/vulnerability-directory/cve-2025-2336?angularjs-nes
1107519 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1107519
GHSA-4p4w-6hg8-63wx https://github.com/advisories/GHSA-4p4w-6hg8-63wx
USN-7958-1 https://usn.ubuntu.com/7958-1/
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L Found at https://codepen.io/herodevs/pen/bNGYaXx/412a3a4218387479898912f60c269c6c
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-06-04T18:14:00Z/ Found at https://codepen.io/herodevs/pen/bNGYaXx/412a3a4218387479898912f60c269c6c
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L Found at https://github.com/angular/angular.js
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L Found at https://lists.debian.org/debian-lts-announce/2025/07/msg00005.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L Found at https://nvd.nist.gov/vuln/detail/CVE-2025-2336
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L Found at https://www.herodevs.com/vulnerability-directory/cve-2025-2336
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-06-04T18:14:00Z/ Found at https://www.herodevs.com/vulnerability-directory/cve-2025-2336
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L Found at https://www.herodevs.com/vulnerability-directory/cve-2025-2336?angularjs-nes
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.41961
EPSS Score 0.00198
Published At April 18, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-04-01T12:56:54.552650+00:00 GithubOSV Importer Import https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/06/GHSA-4p4w-6hg8-63wx/GHSA-4p4w-6hg8-63wx.json 38.0.0