CVE-2025-4690 Details
Description
A regular expression used by AngularJS' linky https://docs.angularjs.org/api/ngSanitize/filter/linky filter to detect URLs in input text is vulnerable to super-linear runtime due to backtracking. With a large carefully-crafted input, this can cause a Regular expression Denial of Service (ReDoS) https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS attack on the application. This issue affects all versions of AngularJS. Note: The AngularJS project is End-of-Life and will not receive any updates to address this issue. For more information see here https://docs.angularjs.org/misc/version-support-status .
A Regular Expression Denial-of-Service (ReDoS) vulnerability has been identified in the AngularJS framework, specifically within the 'ngSanitize' module's 'linky' filter. This vulnerability affects all versions of AngularJS. The issue arises because the regular expression used to detect URLs in input text has a super-linear runtime due to backtracking. When large, carefully crafted inputs are processed, this can lead to significant performance degradation or even cause the application to crash.
The AngularJS project is End-of-Life and will not receive any updates to address this issue. Users should consider migrating applications away from AngularJS or leverage a commercial support partner like HeroDevs for post-EOL security support.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Aug 19, 2025CISA-ADP
Assessed Aug 19, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://codepen.io/herodevs/pen/RNNEPzP/751b91eab7730dff277523f3d50e4b77 | CISA-ADP | Exploit |
| https://www.herodevs.com/vulnerability-directory/cve-2025-4690 | CISA-ADP | AdvisoryExploitRemedy |
| https://codepen.io/herodevs/pen/RNNEPzP/751b91eab7730dff277523f3d50e4b77 | HeroDevs | Exploit |
| https://www.herodevs.com/vulnerability-directory/cve-2025-4690 | HeroDevs | AdvisoryExploitRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1333 | Inefficient Regular Expression Complexity | HeroDevs |
Affected Products
| Product | Versions |
|---|---|
| AngularJS | >= 0.0.0 (semver) |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | HeroDevs |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Aug 19, 2025 | New CVE Received | HeroDevs |
| Aug 19, 2025 | CVE Modified | CISA-ADP |