AngularJS's ngSanitize module improperly sanitizes the 'href' and 'xlink:href' attributes in SVG <image> elements, allowing attackers to bypass image source restrictions. This vulnerability can lead to content spoofing and degrade application performance by loading large or slow images. It affects AngularJS versions from 1.3.1 through 1.8.3. The AngularJS project is end-of-life and will not receive patches for this issue.