CVE-2025-4690— AngularJS 'linky' filter ReDoS
Possible ATT&CK Techniques 1AI
T1496 · Resource HijackingGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2025-4690
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
AngularJS 'linky' filter ReDoS
Source: CVE Program / CVE List V5
Vulnerability Description
A regular expression used by AngularJS' linky https://docs.angularjs.org/api/ngSanitize/filter/linky filter to detect URLs in input text is vulnerable to super-linear runtime due to backtracking. With a large carefully-crafted input, this can cause a Regular expression Denial of Service (ReDoS) https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS attack on the application. This issue affects all versions of AngularJS. Note: The AngularJS project is End-of-Life and will not receive any updates to address this issue. For more information see here https://docs.angularjs.org/misc/version-support-status .
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
CWE-1333
Source: CVE Program / CVE List V5
Vulnerability Title
AngularJS 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
AngularJS是AngularJS开源的一款基于TypeScript的开源Web应用程序框架。 AngularJS存在安全漏洞，该漏洞源于linky过滤器使用的正则表达式存在回溯问题，可能导致正则表达式拒绝服务攻击。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2025-4690
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-4690
请登录查看更多情报信息。
Other References for CVE-2025-4690 (1)
- https://www.herodevs.com/vulnerability-directory/cve-2025-4690third-party-advisory
IV. Related Vulnerabilities
Same product: AngularJS
- CVE-2026-11998
AngularJS XSS via SCE resource URL sanitization bypass - CVE-2025-2336
AngularJS improper sanitization in SVG '<image>' element wit - CVE-2025-0716
AngularJS improper sanitization in SVG '<image>' element - CVE-2024-8373
AngularJS improper sanitization in '<source>' element - CVE-2024-8372
AngularJS improper sanitization in 'srcset' attribute
Same weakness: CWE-1333
- CVE-2026-59893
sqlparse: Inefficient Regex Handling of Dollar-Quoted SQL Li - CVE-2026-69207
Hono: ReDoS in CORS middleware via Access-Control-Request-He - CVE-2026-66062
SvelteKit: ReDoS (O(n^2)) in content negotiation — unauthent - CVE-2026-67422
pymdown-extensions: Exponential-backtracking ReDoS in caret, - CVE-2026-68749
Quadratic regex backtracking in the html_sanitize_ex CSS scr
V. Comments for CVE-2025-4690
No comments yet