What is the CVSS score of CVE-2025-2336?

CVE-2025-2336 has a CVSS 3.1 base score of 4.8 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.1%.

Which versions of Ubuntu are affected by CVE-2025-2336?

CVE-2025-2336 presents moderate security risk rated CVSS 4.8. Exploitation could compromise the security of affected deployments.. A patch is available.

How to fix or mitigate CVE-2025-2336?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Ubuntu CVE-2025-2336

EUVD-2025-16899 MEDIUM

Incomplete Filtering of Special Elements (CWE-791)

2025-06-04 36c7be3b-2937-45df-85ea-ca7133ea542c

GHSA-4p4w-6hg8-63wx

Authentication Bypass Debian Ubuntu

4.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.8 MEDIUM

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L

Ubuntu

MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

EUVD ID Assigned

Mar 14, 2026 - 17:29 euvd

EUVD-2025-16899

Analysis Generated

Mar 14, 2026 - 17:29 vuln.today

CVE Published

Jun 04, 2025 - 17:15 nvd

MEDIUM 4.8

DescriptionCVE.org

Improper sanitization of the value of the 'href' and 'xlink:href' attributes in '<image>' SVG elements in AngularJS's 'ngSanitize' module allows attackers to bypass common image source restrictions. This can lead to a form of Content Spoofing https://owasp.org/www-community/attacks/Content_Spoofing and also negatively affect the application's performance and behavior by using too large or slow-to-load images.

This issue affects AngularJS versions greater than or equal to 1.3.1.

Note: The AngularJS project is End-of-Life and will not receive any updates to address this issue. For more information see here https://docs.angularjs.org/misc/version-support-status .

AnalysisAI

A remote code execution vulnerability (CVSS 4.8) that allows attackers. Remediation should follow standard vulnerability management procedures.

Technical ContextAI

Vulnerability type: remote code execution.

RemediationAI

Monitor vendor channels for patch availability.

Same weakness CWE-791 – Incomplete Filtering of Special Elements

View all

CVE-2022-2132 HIGH POC

8.6

CVE-2026-86206 MEDIUM POC

6.9

CVE-2025-0324 CRITICAL

9.4

CVE-2025-2040 MEDIUM POC

5.3

CVE-2025-3841 MEDIUM POC

4.8

CVE-2024-47590 HIGH

8.8

CVE-2026-44232 HIGH

8.7

CVE-2024-39283 HIGH

8.5

Same technique Authentication Bypass

View all

CVE-2023-22515 CRITICAL POC

9.8

CVE-2012-4681 CRITICAL POC

9.8

CVE-2013-2465 CRITICAL POC

9.8

CVE-2011-3544 CRITICAL POC

9.8

CVE-2022-40684 CRITICAL POC

9.8

CVE-2025-61882 CRITICAL POC

9.8

CVE-2024-0012 CRITICAL POC

9.3

CVE-2023-46805 HIGH POC

8.2

Vendor StatusVendor

Ubuntu

Priority: Medium

angular.js

Release	Status	Version
xenial	not-affected	code not present
upstream	ignored	upstream EOL
oracular	ignored	end of life, was ignored [upstream EOL]
bionic	released	1.5.10-1ubuntu0.1~esm1
focal	released	1.7.9-1ubuntu0.1~esm1
jammy	released	1.8.2-2ubuntu0.1
noble	released	1.8.3-1ubuntu0.24.04.1
plucky	released	1.8.3-1ubuntu0.25.04.1
questing	not-affected	1.8.3-3

USN-7958-1

Debian

Bug #1107519

angular.js

Release	Status	Fixed Version	Urgency
bullseye	fixed	1.8.3-1+deb12u1~deb11u1	-
bullseye (security)	fixed	1.8.3-1+deb12u1~deb11u1	-
bookworm	fixed	1.8.3-1+deb12u1	-
forky, sid, trixie	fixed	1.8.3-3	-
(unstable)	fixed	1.8.3-2	-

DLA-4242-1

CVE-2025-2336 vulnerability details – vuln.today

Back

Ubuntu CVE-2025-2336

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same weakness CWE-791 – Incomplete Filtering of Special Elements

Same technique Authentication Bypass

Vendor StatusVendor

Ubuntu

Debian

Share

External POC / Exploit Code