CVE-2025-71465
@kolkov/angular-editor before 3.0.3 XSS via refreshView()
CVSS Score
6.1
EPSS Score
0.0%
EPSS Percentile
0th
@kolkov/angular-editor before 3.0.3 contains a cross-site scripting vulnerability in refreshView() that writes HTML from ngModel or reactive form controls to innerHTML without DomSanitizer, bypassing the default sanitize option. Attackers can store HTML with event-handler attributes in content later loaded into the editor to execute script in the application's origin for users opening it.
| CWE | CWE-79 |
| Vendor | kolkov |
| Product | angular-editor |
| Published | Nov 14, 2026 |
Stay Ahead of the Next One
Get instant alerts for kolkov angular-editor
Be the first to know when new medium vulnerabilities affecting kolkov angular-editor are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None
Affected Versions
kolkov / angular-editor
0 < 3.0.3
References
github.com: https://github.com/kolkov/angular-editor/issues/580 github.com: https://github.com/kolkov/angular-editor/commit/774a97d0b30e257a07c5d426548c9b900c8a8975 github.com: https://github.com/kolkov/angular-editor/blob/a74a9b1900a0ecbfefbb701d7c272171101ff454/projects/angular-editor/src/lib/editor/angular-editor.component.ts#L276-L278 github.com: https://github.com/kolkov/angular-editor/releases/tag/v3.0.3 github.com: https://github.com/kolkov/angular-editor vulncheck.com: https://www.vulncheck.com/advisories/kolkov-angular-editor-before-3.0.3-xss-via-refreshview
Credits
Mario Tesoro kolkov