CVE-2025-71465

Name of the Vulnerable Software and Affected Versions @kolkov/angular-editor versions prior to 3.0.3

Description An issue exists where the refreshView() function writes HTML from ngModel or reactive form controls directly to innerHTML without using DomSanitizer. This bypasses the default sanitize option, allowing attackers to store HTML containing event-handler attributes. When this content is subsequently loaded into the editor, it can lead to the execution of arbitrary scripts within the application origin for users who open the affected content.

Recommendations Update @kolkov/angular-editor to version 3.0.3 or later. As a temporary workaround, restrict the input allowed in ngModel or reactive form controls used by the editor to prevent the injection of HTML event-handler attributes.