Cloudanix VulnDB

CVE-2025-0716

Medium · 4.8

CVSS

4.8

EPSS

0.4%

Published

Apr 29, 2025

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A flaw in how some web applications handle images inside SVG files can let attackers show fake content or slow down the site, and the underlying software is no longer supported with fixes.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Moderate
Impact
Data Tampering
Component
Web Framework
Class
Improper Input Validation
Remediation
No Fix Yet
Effort
Other
Patch risk
Other

What it actually does

Improper sanitization of 'href' and 'xlink:href' attributes in <image> SVG elements allows bypass of image source restrictions, enabling content spoofing and injection of large or slow-loading images that degrade performance.

Why it matters to the business

Applications may display misleading or malicious content to users and suffer reduced performance or unexpected behavior; the affected library is end-of-life with no official patches, increasing long-term maintenance costs for any remaining deployments.

How an attack unfolds

An attacker crafts a malicious SVG containing an <image> element with a manipulated href or xlink:href attribute that evades existing source checks, then delivers the SVG to the victim application where AngularJS renders it without proper validation.

How to fix it

Migrate away from AngularJS to a supported framework; for the listed python-gevent packages on Red Hat Enterprise Linux 8, upgrade to version 0:1.2.2-5.el8_10 or later; implement additional input validation and content security policies around SVG rendering.

How to confirm the fix worked

Review application dependencies for AngularJS usage, test SVG rendering paths with crafted href attributes, and verify package versions match the fixed releases (0:1.2.2-5.el8_10) using package managers or vulnerability scanners.

Typical attack path

  1. Identify an AngularJS application that processes untrusted SVG input
  2. Craft an <image> element with unsanitized href or xlink:href pointing to attacker-controlled or oversized resources
  3. Deliver the SVG via user-controlled input such as file upload or data binding
  4. Application renders the SVG, bypassing source restrictions and loading the spoofed or resource-intensive image

How to detect it

Search web server and application logs for requests containing SVG payloads with unusual href or xlink:href values; monitor client-side rendering events for unexpected image loads or performance degradation.

What your security team should do

  • Prioritize migration off AngularJS due to end-of-life status
  • Apply the specified package updates for python-gevent on Red Hat Enterprise Linux 8
  • Add server-side and client-side validation for SVG attributes
  • Enforce strict content security policies to limit image sources

The record

Improper sanitization of the value of the 'href' and 'xlink:href' attributes in '<image>' SVG elements in AngularJS allows attackers to bypass common image source restrictions. This can lead to a form of Content Spoofing https://owasp.org/www-community/attacks/Content_Spoofing  and also negatively affect the application's performance and behavior by using too large or slow-to-load images. This issue affects all versions of AngularJS. Note: The AngularJS project is End-of-Life and will not receive any updates to address this issue. For more information see here https://docs.angularjs.org/misc/version-support-status .

Affected packages

Ecosystem Package Introduced Fixed
npm angular 0 No fix
Chainguard solr 0 9.10.1-r0
Chainguard solr-oci-compat 0 9.9.0-r3
Debian:11 angular.js 0 No fix
Debian:12 angular.js 0 No fix
Debian:13 angular.js 0 No fix
Wolfi solr 0 9.10.1-r0
Wolfi solr-oci-compat 0 9.9.0-r3

Related vulnerabilities