[Git][security-tracker-team/security-tracker][master] CVE-2025-4690/angular.js

[Bastien Roucariès (@rouca)]

Bastien Roucariès pushed to branch master at Debian Security Tracker / security-tracker


Commits:
c3bfc199 by Bastien Roucariès at 2026-02-16T21:24:47+01:00
CVE-2025-4690/angular.js

Add vulnerable code link

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -68710,6 +68710,8 @@ CVE-2025-4690 (A regular expression used by AngularJS' linky https://docs.angula
 	- angular.js <unfixed> (bug #1126778)
 	NOTE: https://www.herodevs.com/vulnerability-directory/cve-2025-4690
 	NOTE: https://codepen.io/herodevs/pen/RNNEPzP/751b91eab7730dff277523f3d50e4b77
+	NOTE: vulnerable REDOS: https://salsa.debian.org/js-team/angular.js/-/blob/4ff98f444e79456ecc442efd4369db6c423e88e1/src/ngSanitize/filter/linky.js#L131
+	NOTE: vulnerable match: https://salsa.debian.org/js-team/angular.js/-/blob/4ff98f444e79456ecc442efd4369db6c423e88e1/src/ngSanitize/filter/linky.js#L155
 CVE-2025-4046 (A missing authorization vulnerability in Lexmark Cloud Services badge  ...)
 	NOT-FOR-US: Lexmark
 CVE-2025-4044 (Improper Restriction of XML External Entity Reference in various Lexma ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/c3bfc1993de976cdc31d1db757c35066c2409ec0

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/c3bfc1993de976cdc31d1db757c35066c2409ec0
You're receiving this email because of your account on salsa.debian.org.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260216/19e1e17f/attachment-0001.htm>