USN-7958-1: AngularJS vulnerabilities

Published Jan 14, 2026
·
Updated

It was discovered that AngularJS did not properly sanitize certain xlink:href attributes. A remote attacker could possibly use this issue to perform cross site scripting. This issue only affected Ubuntu 16.04 LTS. (CVE-2019-14863) It was discovered that AngularJS incorrectly handled certain regular expressions. An attacker could possibly use this issue to cause AngularJS to consume resources, leading to a regular expression denial of service. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and Ubuntu 25.04. (CVE-2022-25844) It was discovered that AngularJS incorrectly handled certain regular expressions. An attacker could possibly use this issue to cause AngularJS to consume resources, leading to a regular expression denial of service. (CVE-2023-26116, CVE-2023-26117) It was discovered that AngularJS incorrectly handled certain regular expressions. An attacker could possibly use this issue to cause AngularJS to consume resources, leading to a regular expression denial of service. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and Ubuntu 25.04. (CVE-2023-26118, CVE-2024-21490) It was discovered that AngularJS did not properly sanitize certain inputs in HTML elements. A remote attacker could possibly use this issue to perform spoofing and obtain sensitive information. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and Ubuntu 25.04. (CVE-2024-8372, CVE-2024-8373, CVE-2025-2336) It was discovered that AngularJS did not properly sanitize certain inputs in HTML elements. A remote attacker could possibly use this issue to perform spoofing and obtain sensitive information. (CVE-2025-0716)

Affected Software

12 affected componentsFixes available
All of the following
ubuntu/libjs-angularjs<1.8.3-1ubuntu0.25.04.1
1.8.3-1ubuntu0.25.04.1
Ubuntu Ubuntu=25.04
All of the following
ubuntu/libjs-angularjs<1.8.3-1ubuntu0.24.04.1
1.8.3-1ubuntu0.24.04.1
Ubuntu Ubuntu=24.04
All of the following
ubuntu/libjs-angularjs<1.8.2-2ubuntu0.1
1.8.2-2ubuntu0.1
Ubuntu Ubuntu=22.04
All of the following
ubuntu/libjs-angularjs<Ubuntu Pro
Ubuntu Pro
Ubuntu Ubuntu=20.04
All of the following
ubuntu/libjs-angularjs<Ubuntu Pro
Ubuntu Pro
Ubuntu Ubuntu=18.04
All of the following
ubuntu/libjs-angularjs<Ubuntu Pro
Ubuntu Pro
Ubuntu Ubuntu=16.04

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade ubuntu/libjs-angularjs to a version that resolves this vulnerability.

    Fixed in 1.8.3-1ubuntu0.25.04.1
  2. Upgrade

    Upgrade ubuntu/libjs-angularjs to a version that resolves this vulnerability.

    Fixed in 1.8.3-1ubuntu0.24.04.1
  3. Upgrade

    Upgrade ubuntu/libjs-angularjs to a version that resolves this vulnerability.

    Fixed in 1.8.2-2ubuntu0.1
  4. Upgrade

    Upgrade ubuntu/libjs-angularjs to a version that resolves this vulnerability.

    Fixed in Ubuntu Pro

Event History

Jan 14, 2026
Advisory Published
via Ubuntu·12:00 AM
Data Sourced
via Ubuntu·12:00 AM
DescriptionAffected Software

Frequently Asked Questions

1

Are all of the listed issues relevant to every Ubuntu release?

No. The xlink:href cross-site scripting issue (CVE-2019-14863) affects only Ubuntu 16.04 LTS. The regular-expression issue CVE-2022-25844 affects Ubuntu 20.04 LTS through Ubuntu 25.04, while CVE-2023-26118 and CVE-2024-21490 affect Ubuntu 18.04 LTS through Ubuntu 25.04.

2

What impact should be prioritized for systems using affected AngularJS packages?

The xlink:href flaw can allow a remote attacker to perform cross-site scripting on affected Ubuntu 16.04 LTS systems. The regular-expression flaws can cause AngularJS to consume resources, resulting in regular-expression denial of service.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203