CVE-2025-71464

CVSS 6.1 (medium) · published 2026-11-14

@kolkov/angular-editor before 3.0.4 contains a cross-site scripting vulnerability in toggleEditorMode() that assigns source view text to innerHTML without DomSanitizer sanitization. Attackers can induce users to paste HTML with event handlers such as img onerror into source mode, executing script in the application's origin when toggling views.

Weakness: CWE-79

Source: NVD CVE-2025-71464

References

• https://github.com/kolkov/angular-editor
• https://github.com/kolkov/angular-editor/blob/a56cc1672e29f058f1b28dba3f532b4040b56439/projects/angular-editor/src/lib/editor/angular-editor.component.ts#L354-L361
• https://github.com/kolkov/angular-editor/commit/1b6ee6763ccc93cf0ddd4ab47380166b5efb8f5e
• https://github.com/kolkov/angular-editor/issues/580
• https://github.com/kolkov/angular-editor/pull/587
• https://github.com/kolkov/angular-editor/releases/tag/v3.0.4
• https://www.vulncheck.com/advisories/kolkov-angular-editor-before-3.0.4-xss-via-toggleeditormode

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.