CVE-2025-4690
BaseFortify
Publication date: 2025-08-19
Last updated on: 2025-08-20
Assigner: HeroDevs
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| angular | angularjs | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-1333 | The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-4690 is a Regular Expression Denial of Service (ReDoS) vulnerability in AngularJS's angular-sanitize module, specifically in the linky filter that detects URLs in input text. The vulnerability arises because the regular expression used for URL detection has a flaw causing super-linear (exponential) runtime when processing specially crafted large inputs. An attacker can exploit this by providing such input, causing the application to consume excessive processing time and resources, potentially hanging or crashing it. [1]
How can this vulnerability impact me? :
This vulnerability can impact you by allowing an attacker to cause a denial of service on your AngularJS application. By submitting a carefully crafted input string, the attacker can trigger excessive processing in the vulnerable regular expression, leading to high CPU usage, application hangs, or crashes. This disrupts the availability of your application to legitimate users. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by testing the AngularJS application using the ngSanitize module's linky filter with specially crafted long input strings that trigger the super-linear regex processing. A proof-of-concept demonstrating the ReDoS attack is publicly available, which can be used to reproduce and detect the issue. Specific commands are not provided, but detection involves inputting crafted data into the application to observe excessive processing or hanging behavior. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include migrating away from AngularJS since it is End-of-Life and no longer maintained, or obtaining commercial support such as HeroDevs' Never-Ending Support (NES) versions of AngularJS (v1.9.10 or v1.5.26) which include fixes for this vulnerability. Applying these patched versions or moving to a maintained framework are the recommended actions to prevent exploitation. [1]