EUVD-2025-211336

@kolkov/angular-editor before 3.0.3 contains a cross-site scripting vulnerability in refreshView that writes HTML from ngModel or reactive form controls to innerHTML without DomSanitizer, bypassing the default sanitize option. Attackers can store HTML with event-handler attributes in content late...