CVE-2025-4690: AngularJS 'linky' filter ReDoS
A regular expression used by AngularJS' linky https://docs.angularjs.org/api/ngSanitize/filter/linky filter to detect URLs in input text is vulnerable to super-linear runtime due to backtracking. With a large carefully-crafted input, this can cause a
Regular expression Denial of Service (ReDoS) https://owasp.org/www-community/attacks/RegularexpressionDenialofService-ReDoS attack on the application.
This issue affects all versions of AngularJS.
Note: The AngularJS project is End-of-Life and will not receive any updates to address this issue. For more information see here https://docs.angularjs.org/misc/version-support-status .
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-4690?
CVE-2025-4690 is classified as a moderate severity vulnerability due to the potential for Denial of Service attacks.
How do I fix CVE-2025-4690?
To fix CVE-2025-4690, update AngularJS to a version that has addressed this regular expression vulnerability.
What systems are affected by CVE-2025-4690?
CVE-2025-4690 affects all versions of Google AngularJS up to and including 0.0.0.
What impact does CVE-2025-4690 have on applications?
CVE-2025-4690 can lead to denial of service by causing super-linear runtime backtracking with maliciously crafted input.
When was CVE-2025-4690 reported?
CVE-2025-4690 was reported in 2025, highlighting a vulnerability in the linky filter of AngularJS.