CVE-2025-0716: AngularJS Improper Sanitization of SVG Elements Leading to Content Spoofing
Summary
CVE-2025-0716: AngularJS improperly sanitizes SVG elements. Affects angular versions < 1.8.3. No fix is published. How to fix ↓
Also tracked for
- angular.js · Debian:11
The same CVE-2025-0716 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
AngularJS is a widely-used open-source web application framework designed for building dynamic single-page applications. It provides a structured approach to web development, enabling developers to create rich user interfaces with features like two-way data binding, dependency injection, and modularity. However, AngularJS has reached its End-of-Life status, meaning it no longer receives updates or security patches, making it vulnerable to various security issues, including improper sanitization of SVG elements.
Vulnerability Detail
The vulnerability arises from AngularJS's improper sanitization of the 'href' and 'xlink:href' attributes in '<image>' SVG elements. This flaw allows attackers to bypass standard image source restrictions, potentially leading to content spoofing attacks. Such attacks can mislead users by displaying malicious content instead of legitimate images, thereby compromising the integrity of the application. Additionally, the use of excessively large or slow-loading images can degrade application performance and user experience.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, you can implement strict content security policies (CSP) to mitigate the risk of content spoofing. Additionally, avoid using SVG elements with dynamic attributes in your application until a migration is complete. Here is an example of a CSP header you can use:
Content-Security-Policy: default-src 'self'; img-src 'self' data:; object-src 'none';
Conclusion
CVE-2025-0716 highlights a significant vulnerability in AngularJS related to improper sanitization of SVG elements. With no available patch and the framework's End-of-Life status, it is crucial for developers to consider migrating to a supported framework to maintain application security and performance.
See every vulnerability recorded for angular →
FAQ
CVE-2025-0716 is a vulnerability in AngularJS that involves improper sanitization of SVG elements, allowing for potential content spoofing attacks.
All versions of AngularJS are affected by this vulnerability, as the issue exists in the framework's handling of SVG elements.
Attackers can exploit this vulnerability to display malicious content, mislead users, and degrade application performance by using large or slow-loading images.
No, there is no patch available since AngularJS has reached its End-of-Life status and will not receive further updates.
You can use Vulert, a tool that monitors open-source vulnerabilities in your software. By analyzing your package-lock.json file, Vulert can alert you to any vulnerabilities, including CVE-2025-0716. You can also check your application using the Vulert playground without any signup.
Related vulnerabilities
Recent vulnerabilities recorded for angular.
