Cloud Vulnerability DB
An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues
Vulnerability DatabaseCVE-2025-0716
CVE-2025-0716:
AngularJS vulnerability analysis and mitigation
Overview
CVE-2025-0716 is a vulnerability discovered in AngularJS affecting all versions of the framework. The vulnerability was disclosed on April 29, 2025, and involves improper sanitization of the 'href' and 'xlink:href' attributes in SVG elements. This security flaw allows attackers to bypass common image source restrictions (HeroDevs).
Technical details
The vulnerability stems from a bug in AngularJS where setting an SVG element's href or xlink:href attribute values via the ngHref and ngAttrHref directives or using interpolation bypasses image source sanitization. The issue has been assigned a CVSS v3.1 base score of 4.8 (Medium) with the vector string CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L (NVD).
Impact
The vulnerability can lead to content spoofing attacks and negatively affect application performance. Attackers can bypass configured image source restrictions, potentially leading to the loading of unauthorized images from any domain. Additionally, the bypass can be exploited to load oversized or slow-loading images, impacting the application's performance and behavior (HeroDevs).
Mitigation and workarounds
As AngularJS is End-of-Life, no official patches will be released to address this vulnerability. Users are recommended to either migrate their applications away from AngularJS or leverage commercial support partners for post-EOL security support. For those using HeroDevs Never-Ending Support (NES), the vulnerability has been fixed in AngularJS NES v1.9.8 and v1.5.24 (HeroDevs).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
Ready to see Wiz in action?
“Best User Experience I have ever seen, provides full visibility to cloud workloads.”
David EstlickCISO
“Wiz provides a single pane of glass to see what is going on in our cloud environments.”
Adam FletcherChief Security Officer
“We know that if Wiz identifies something as critical, it actually is.”
Greg PoniatowskiHead of Threat and Vulnerability Management