EUVD-2025-211336

@kolkov/angular-editor before 3.0.3 contains a cross-site scripting vulnerability in refreshView that writes HTML from ngModel or reactive form controls to innerHTML without DomSanitizer, bypassing the default sanitize option. Attackers can store HTML with event-handler attributes in content late...

CVE-2025-71465

The @kolkov/angular-editor library (versions prior to 3.0.3 ) is vulnerable to a cross-site scripting (XSS) flaw within the refreshView() function. The root cause is the direct injection of HTML from ngModel or reactive form controls into the innerHTML without using DomSanitizer , effectively byp...