CVE-2025-2336 (Medium) detected in angular-sanitize-1.8.3.tgz

[mend-bolt-for-github]

CVE-2025-2336 - Medium Severity Vulnerability

Vulnerable Library - angular-sanitize-1.8.3.tgz

AngularJS module for sanitizing HTML

Library home page: https://registry.npmjs.org/angular-sanitize/-/angular-sanitize-1.8.3.tgz

Path to dependency file: /package.json

Path to vulnerable library: /home/wss-scanner/.yarn/berry/cache/angular-sanitize-npm-1.8.3-cdd4180b10-10.zip

Dependency Hierarchy:

• ❌ angular-sanitize-1.8.3.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

Improper sanitization of the value of the 'href' and 'xlink:href' attributes in '' SVG elements in AngularJS's 'ngSanitize' module allows attackers to bypass common image source restrictions. This can lead to a form of Content Spoofing https://owasp.org/www-community/attacks/Content_Spoofing  and also negatively affect the application's performance and behavior by using too large or slow-to-load images.
This issue affects AngularJS versions greater than or equal to 1.3.1.
Note:
The AngularJS project is End-of-Life and will not receive any updates to address this issue. For more information see here https://docs.angularjs.org/misc/version-support-status .

Publish Date: 2025-06-04

URL: CVE-2025-2336

CVSS 3 Score Details (4.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: Low
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

---

Step up your Open Source Security Game with Mend here