CVE-2025-71464 · Package
NO FIX YET · SEE WHAT TO DO
The @kolkov/angular-editor npm package assigns source-view text to innerHTML without Angular sanitization in toggleEditorMode(). An attacker who gets a user to paste crafted HTML, such as an img tag with an onerror handler, into source mode can run script in the application's origin when the view is toggled.
first public Nov 14, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Applications that embed @kolkov/angular-editor and let users edit or paste HTML into it are exposed, because script runs in the application's own origin. Apps that do not use this editor, or that do not let users paste into it, are not affected.
Not affected if not-using-package
Who cares @kolkov/angular-editor, angular, npm
@kolkov/angular-editor in package.json and the lockfile.@kolkov/angular-editor before 3.0.4: move to 3.0.4 or later.@kolkov/angular-editor before 3.0.4 contains a cross-site scripting vulnerability in toggleEditorMode() that assigns source view text to innerHTML without DomSanitizer sanitization. Attackers can induce users to paste HTML with event handlers such as img onerror into source mode, executing script in the application's origin when toggling views.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.