4.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-2336

CVE-2025-2336: AngularJS Incomplete Filtering of Special Elements vulnerability

Improper sanitization of the value of the 'href' and 'xlink:href' attributes in '<image>' SVG elements in AngularJS's 'ngSanitize' module allows attackers to bypass common image source restrictions. This can lead to a form of Content Spoofing https://owasp.org/www-community/attacks/Content_Spoofing and also negatively affect the application's performance and behavior by using too large or slow-to-load images.

This issue affects AngularJS versions greater than or equal to 1.3.1.

Note: The AngularJS project is End-of-Life and will not receive any updates to address this issue. For more information see here https://docs.angularjs.org/misc/version-support-status .

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-2336

CVE-2025-2336:

4.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
angular-sanitize	npm	>= 1.3.1, <= 1.8.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability (CVE-2025-2336) stems from improper sanitization within AngularJS's ngSanitize module, specifically in the $sanitize service. When SVG support is enabled (via $sanitizeProvider.enableSvg(true)), the $sanitize service fails to correctly identify and apply configured image source restrictions (from $compileProvider.imgSrcSanitizationTrustedUrlList()) to the href and xlink:href attributes of SVG <image> elements. This allows attackers to bypass these restrictions, leading to content spoofing by embedding images from arbitrary domains, and potentially causing performance issues with large or slow-loading images.

The primary vulnerable function is $sanitize itself, as it contains the defective logic. However, other components that utilize $sanitize for processing HTML content also become vulnerable. These include the linkyFilter (from the ngSanitize module) and the ngBindHtml directive (a core directive that uses $sanitize when available). If these components are fed attacker-controlled input that includes the specially crafted SVG <image> tags, they will invoke the vulnerable $sanitize service, thus exposing the application.

Since AngularJS is End-of-Life, no official patches address this issue. The identification of vulnerable functions is based on the detailed vulnerability analysis provided by third parties like HeroDevs.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.