CVE-2025-71465

@kolkov/angular-editor before 3.0.3 contains a cross-site scripting vulnerability in refreshView that writes HTML from ngModel or reactive form controls to innerHTML without DomSanitizer, bypassing the default sanitize option. Attackers can store HTML with event-handler attributes in content late...

CVE-2025-71464

@kolkov/angular-editor before 3.0.4 contains a cross-site scripting vulnerability in toggleEditorMode that assigns source view text to innerHTML without DomSanitizer sanitization. Attackers can induce users to paste HTML with event handlers such as img onerror into source mode, executing script i...

CVE-2025-71464 @kolkov/angular-editor before 3.0.4 XSS via toggleEditorMode()

@kolkov/angular-editor before 3.0.4 contains a cross-site scripting vulnerability in toggleEditorMode that assigns source view text to innerHTML without DomSanitizer sanitization. Attackers can induce users to paste HTML with event handlers such as img onerror into source mode, executing script i...

CVE-2025-71464

The @kolkov/angular-editor library (versions before 3.0.4 ) is vulnerable to a Cross-Site Scripting (XSS) flaw within the toggleEditorMode() function. The root cause is the assignment of source view text to innerHTML without utilizing DomSanitizer for proper sanitization. An attacker can trick a ...

EUVD-2025-211337

@kolkov/angular-editor before 3.0.4 contains a cross-site scripting vulnerability in toggleEditorMode that assigns source view text to innerHTML without DomSanitizer sanitization. Attackers can induce users to paste HTML with event handlers such as img onerror into source mode, executing script i...

EUVD-2025-211336

@kolkov/angular-editor before 3.0.3 contains a cross-site scripting vulnerability in refreshView that writes HTML from ngModel or reactive form controls to innerHTML without DomSanitizer, bypassing the default sanitize option. Attackers can store HTML with event-handler attributes in content late...

CVE-2025-71465 @kolkov/angular-editor before 3.0.3 XSS via refreshView()

@kolkov/angular-editor before 3.0.3 contains a cross-site scripting vulnerability in refreshView that writes HTML from ngModel or reactive form controls to innerHTML without DomSanitizer, bypassing the default sanitize option. Attackers can store HTML with event-handler attributes in content late...

CVE-2025-71465

The @kolkov/angular-editor library (versions prior to 3.0.3 ) is vulnerable to a cross-site scripting (XSS) flaw within the refreshView() function. The root cause is the direct injection of HTML from ngModel or reactive form controls into the innerHTML without using DomSanitizer , effectively byp...

CVE-2025-71464: kolkov angular-editor: @kolkov/angular-editor before 3.0.4 contains a cross-site scripting vulnerability in toggleEditorMode() that assigns…

@kolkov/angular-editor before 3.0.4 contains a cross-site scripting vulnerability in toggleEditorMode that assigns source view text to innerHTML without DomSanitizer sanitization. Attackers can induce users to paste HTML with event handlers such as img onerror into source mode, executing script i...

CVE-2025-71465: kolkov angular-editor: @kolkov/angular-editor before 3.0.3 contains a cross-site scripting vulnerability in refreshView() that writes HTML…

@kolkov/angular-editor before 3.0.3 contains a cross-site scripting vulnerability in refreshView that writes HTML from ngModel or reactive form controls to innerHTML without DomSanitizer, bypassing the default sanitize option. Attackers can store HTML with event-handler attributes in content late...

PT-2026-147410

@kolkov/angular-editor before 3.0.4 contains a cross-site scripting vulnerability in toggleEditorMode that assigns source view text to innerHTML without DomSanitizer sanitization. Attackers can induce users to paste HTML with event handlers such as img onerror into source mode, executing script i...

PT-2026-147411

Name of the Vulnerable Software and Affected Versions @kolkov/angular-editor versions prior to 3.0.3 Description An issue exists where the refreshView function writes HTML from ngModel or reactive form controls directly to innerHTML without using DomSanitizer. This bypasses the default sanitize...