CVE-2025-71464

MEDIUM 6.1

@kolkov/angular-editor before 3.0.4 XSS via toggleEditorMode()

CVSS Score

6.1

EPSS Score

0.0%

EPSS Percentile

0th

@kolkov/angular-editor before 3.0.4 contains a cross-site scripting vulnerability in toggleEditorMode() that assigns source view text to innerHTML without DomSanitizer sanitization. Attackers can induce users to paste HTML with event handlers such as img onerror into source mode, executing script in the application's origin when toggling views.

CWE	CWE-79
Vendor	kolkov
Product	angular-editor
Published	Nov 14, 2026

Stay Ahead of the Next One

Get instant alerts for kolkov angular-editor

Be the first to know when new medium vulnerabilities affecting kolkov angular-editor are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Affected Versions

kolkov / angular-editor

0 < 3.0.4

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/kolkov/angular-editor/issues/580 github.com: https://github.com/kolkov/angular-editor/pull/587 github.com: https://github.com/kolkov/angular-editor/commit/1b6ee6763ccc93cf0ddd4ab47380166b5efb8f5e github.com: https://github.com/kolkov/angular-editor/blob/a56cc1672e29f058f1b28dba3f532b4040b56439/projects/angular-editor/src/lib/editor/angular-editor.component.ts#L354-L361 github.com: https://github.com/kolkov/angular-editor/releases/tag/v3.0.4 github.com: https://github.com/kolkov/angular-editor vulncheck.com: https://www.vulncheck.com/advisories/kolkov-angular-editor-before-3.0.4-xss-via-toggleeditormode

Credits

Mario Tesoro Mario Tesoro