CVE-2025-71464
Received Received - Intake

Angular Editor XSS via Unsanitized innerHTML in Source Mode

Publication date: 2026-11-14

Last updated on: 2026-11-14

Assigner: VulnCheck

Description
@kolkov/angular-editor before 3.0.4 contains a cross-site scripting vulnerability in toggleEditorMode() that assigns source view text to innerHTML without DomSanitizer sanitization. Attackers can induce users to paste HTML with event handlers such as img onerror into source mode, executing script in the application's origin when toggling views.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-14
Last Modified
2026-11-14
Generated
2026-11-15
AI Q&A
2026-11-14
EPSS Evaluated
N/A
NVD
CVE-2025-71464
EUVD
EUVD-2025-211337

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
kolkov angular-editor to 3.0.4 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2025-71464 is a cross-site scripting (XSS) vulnerability in the @kolkov/angular-editor library affecting versions before 3.0.4. The issue occurs in the toggleEditorMode() function where user-provided HTML content is assigned to innerHTML without proper sanitization using Angular's DomSanitizer. Attackers can exploit this by tricking users into pasting malicious HTML with event handlers like img onerror into source mode. When toggling back to the editor view, the script executes in the application's origin.

Detection Guidance

To detect this vulnerability, inspect your Angular application for usage of the @kolkov/angular-editor library versions prior to 3.0.4. Check if the editor's sanitize option is disabled or improperly configured. Look for code paths where toggleEditorMode() or refreshView() methods handle user-provided HTML without sanitization.

Impact Analysis

This vulnerability allows attackers to execute malicious scripts in the context of your application when users interact with the editor. Potential impacts include unauthorized actions, data theft, session hijacking, or defacement of web content. Users pasting untrusted HTML into the editor are particularly at risk.

Compliance Impact

This XSS vulnerability could lead to violations of GDPR (data protection) and HIPAA (health information privacy) by enabling unauthorized access to sensitive user data. If exploited, it may result in data breaches, unauthorized processing of personal data, or exposure of protected health information, potentially leading to regulatory penalties and legal consequences.

Mitigation Strategies

Immediately upgrade the @kolkov/angular-editor library to version 3.0.4 or later. Ensure the sanitize option is enabled by default. If using a custom sanitizer, verify it properly sanitizes HTML input before rendering. Review and update any editor configurations to enforce sanitization.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-71464. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...