{"id":"CVE-2025-71464","kind":"vulnerability","aliases":["CVE-2025-71464"],"related":[],"title":"Angular editor: source-view toggle lets pasted HTML run scripts","description":"@kolkov/angular-editor before 3.0.4 contains a cross-site scripting vulnerability in toggleEditorMode() that assigns source view text to innerHTML without DomSanitizer sanitization. Attackers can induce users to paste HTML with event handlers such as img onerror into source mode, executing script in the application's origin when toggling views.","summary":"The @kolkov/angular-editor npm package assigns source-view text to innerHTML without Angular sanitization in toggleEditorMode(). An attacker who gets a user to paste crafted HTML, such as an img tag with an onerror handler, into source mode can run script in the application's origin when the view is toggled.","severity":"medium","cvss":6.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["@kolkov/angular-editor","angular","npm","package"],"not_affected_if":["not-using-package"],"how_to_check":"- Check the installed version of `@kolkov/angular-editor` in `package.json` and the lockfile.\n- Look for any use of the editor's source-mode toggle in the application.","fix":"- `@kolkov/angular-editor` before `3.0.4`: move to `3.0.4` or later.","status":"open","published_at":"2026-11-14T13:17:19+00:00","first_seen_at":"2026-11-14T13:28:09+00:00","triaged_at":"2026-11-14T13:29:06+00:00","updated_at":"2026-11-14T13:29:06+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-14T13:29:06Z","model":"claude-haiku-5-5","output":{"fix":"- `@kolkov/angular-editor` before `3.0.4`: move to `3.0.4` or later.","reach":"internet","title":"Angular editor: source-view toggle lets pasted HTML run scripts","impact":"medium","summary":"The @kolkov/angular-editor npm package assigns source-view text to innerHTML without Angular sanitization in toggleEditorMode(). An attacker who gets a user to paste crafted HTML, such as an img tag with an onerror handler, into source mode can run script in the application's origin when the view is toggled.","audience":"developers","category":"package","nicknames":[],"who_cares":["angular","npm","@kolkov/angular-editor"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"script runs in the application origin for other users","analyst_note":"","how_to_check":"- Check the installed version of `@kolkov/angular-editor` in `package.json` and the lockfile.\n- Look for any use of the editor's source-mode toggle in the application.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["not-using-package"],"who_is_affected":"Applications that embed @kolkov/angular-editor and let users edit or paste HTML into it are exposed, because script runs in the application's own origin. Apps that do not use this editor, or that do not let users paste into it, are not affected.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000716,"input_tokens":4628,"output_tokens":506,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2025':13A,16A '-71464':14A,17A '3.0.4':75C 'angular':1A,19B,34B 'applic':65B,116C 'assign':26B,86C 'attack':39B,95C 'contain':76C 'craft':46B 'cross':79C 'cross-sit':78C 'cve':12A,15A 'domsanit':93C 'editor':2A 'event':103C 'execut':112C 'get':41B 'handler':56B,104C 'html':9A,47B,101C 'img':51B,107C 'induc':97C 'innerhtml':32B,91C 'kolkov/angular-editor':18B,23B,73C 'let':7A 'mode':59B,111C 'npm':20B,24B 'onerror':55B,108C 'origin':67B,118C 'packag':21B,25B 'past':8A,45B,100C 'run':10A,61B 'sanit':35B,94C 'script':11A,62B,81C,113C 'site':80C 'sourc':4A,28B,58B,87C,110C 'source-view':3A,27B 'tag':52B 'text':30B,89C 'toggl':6A,72B,120C 'toggleeditormod':37B,84C 'user':43B,98C 'view':5A,29B,70B,88C,121C 'vulner':82C 'without':33B,92C","nicknames":[],"mitigations":[],"who_affected":"Applications that embed @kolkov/angular-editor and let users edit or paste HTML into it are exposed, because script runs in the application's own origin. Apps that do not use this editor, or that do not let users paste into it, are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["angular","angulareditor","medium","npm","package"],"campaign_type":null,"search_a":"'-2025':13A,16A '-71464':14A,17A 'angular':1A 'cve':12A,15A 'editor':2A 'html':9A 'let':7A 'past':8A 'run':10A 'script':11A 'sourc':4A 'source-view':3A 'toggl':6A 'view':5A","search_b":"'angular':19B,34B 'applic':65B 'assign':26B 'attack':39B 'craft':46B 'get':41B 'handler':56B 'html':47B 'img':51B 'innerhtml':32B 'kolkov/angular-editor':18B,23B 'mode':59B 'npm':20B,24B 'onerror':55B 'origin':67B 'packag':21B,25B 'past':45B 'run':61B 'sanit':35B 'script':62B 'sourc':28B,58B 'source-view':27B 'tag':52B 'text':30B 'toggl':72B 'toggleeditormod':37B 'user':43B 'view':29B,70B 'without':33B","search_c":"'3.0.4':75C 'applic':116C 'assign':86C 'attack':95C 'contain':76C 'cross':79C 'cross-sit':78C 'domsanit':93C 'event':103C 'execut':112C 'handler':104C 'html':101C 'img':107C 'induc':97C 'innerhtml':91C 'kolkov/angular-editor':73C 'mode':111C 'onerror':108C 'origin':118C 'past':100C 'sanit':94C 'script':81C,113C 'site':80C 'sourc':87C,110C 'text':89C 'toggl':120C 'toggleeditormod':84C 'user':98C 'view':88C,121C 'vulner':82C 'without':92C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-14T13:17:19+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2025-71464","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71464","severity":null,"published_at":"2026-11-14T13:17:19+00:00","modified_at":"2026-11-14T13:17:19+00:00","first_seen_at":"2026-11-14T13:28:09+00:00","fetched_at":"2026-11-14T13:28:09+00:00","note":null}],"documents":[{"id":155829,"url":"https://github.com/kolkov/angular-editor/commit/1b6ee6763ccc93cf0ddd4ab47380166b5efb8f5e","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":155830,"url":"https://github.com/kolkov/angular-editor/releases/tag/v3.0.4","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":155831,"url":"https://www.vulncheck.com/advisories/kolkov-angular-editor-before-3.0.4-xss-via-toggleeditormode","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}