Bug 2362958 (CVE-2025-0716) - CVE-2025-0716 angular: AngularJS improper sanitization in SVG '<image>' element
Summary: CVE-2025-0716 angular: AngularJS improper sanitization in SVG '<image>' element
Keywords:
Status: NEW
Alias: CVE-2025-0716
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2363071 2363072 2363073 2363074 2363077 2363078 2363079 2363080 2363083 2363062 2363063 2363064 2363065 2363066 2363067 2363068 2363069 2363070 2363075 2363076 2363081 2363082
Blocks:
TreeView+ depends on / blocked
 
Reported: 2025-04-29 17:01 UTC by OSIDB Bzimport
Modified: 2025-06-04 15:58 UTC (History)
61 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2025-04-29 17:01:09 UTC 
Improper sanitization of the value of the 'href' and 'xlink:href' attributes in '<image>' SVG elements in AngularJS allows attackers to bypass common image source restrictions. This can lead to a form of  Content Spoofing https://owasp.org/www-community/attacks/Content_Spoofing  and also negatively affect the application's performance and behavior by using too large or slow-to-load images.

This issue affects all versions of AngularJS.

Note:
The AngularJS project is End-of-Life and will not receive any updates to address this issue. For more information see  here https://docs.angularjs.org/misc/version-support-status .
Note You need to log in before you can comment on or make changes to this bug.