Angular-Editor XSS via Unsanitized ngModel Input

Executive Summary

CVE-2025-71465 is a cross-site scripting (XSS) vulnerability in the @kolkov/angular-editor package before version 3.0.3. The refreshView() function writes HTML from ngModel or reactive form controls to innerHTML without using DomSanitizer, bypassing default sanitization. Attackers can inject HTML with event-handler attributes (like onclick) into editor content. When users open this content, the injected scripts execute within the application's origin.

Useful 0 Not Useful 0

Detection Guidance

Check if your system uses @kolkov/angular-editor versions before 3.0.3 by inspecting package.json or running npm list @kolkov/angular-editor. Look for event-handler attributes like onclick in editor content or inspect network requests for suspicious HTML payloads.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to execute malicious scripts in your application's context when you open affected editor content. This could lead to unauthorized actions, data theft, or session hijacking. Users of the angular-editor library before version 3.0.3 are at risk if they handle user-provided HTML content.

Useful 0 Not Useful 0

Compliance Impact

This XSS vulnerability could lead to unauthorized data access or manipulation, violating GDPR's integrity and confidentiality principles by exposing user data. For HIPAA, it risks breaching protected health information if exploited in healthcare applications.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade @kolkov/angular-editor to version 3.0.3 or later. Ensure DomSanitizer is enabled in editor configurations to sanitize HTML content before rendering. Review and sanitize any stored editor content that may contain malicious scripts.

Useful 0 Not Useful 0