---
id: "CVE-2025-71464"
page: "https://infrastack.ai/live/CVE-2025-71464"
kind: "vulnerability"
aliases: ["CVE-2025-71464"]
title: "Angular editor: source-view toggle lets pasted HTML run scripts"
severity: "medium"
cvss: 6.1
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["@kolkov/angular-editor", "angular", "npm", "package"]
not_affected_if: ["not-using-package"]
published_at: "2026-11-14T13:17:19+00:00"
first_seen_at: "2026-11-14T13:28:09+00:00"
updated_at: "2026-11-14T13:29:06+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-71464", "first_seen_at": "2026-11-14T13:28:09+00:00"}]
exploit_sources: []
---

# Angular editor: source-view toggle lets pasted HTML run scripts

Link for people: https://infrastack.ai/live/CVE-2025-71464 (this .md is for agents)

The @kolkov/angular-editor npm package assigns source-view text to innerHTML without Angular sanitization in toggleEditorMode(). An attacker who gets a user to paste crafted HTML, such as an img tag with an onerror handler, into source mode can run script in the application's origin when the view is toggled.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of `@kolkov/angular-editor` in `package.json` and the lockfile.
- Look for any use of the editor's source-mode toggle in the application.

## Fix

- `@kolkov/angular-editor` before `3.0.4`: move to `3.0.4` or later.

## Timeline

- 2026-11-14T13:28:09+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2025-71464

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/kolkov-angular-editor-before-3.0.4-xss-via-toggleeditormode
- [fix] Patch: github.com https://github.com/kolkov/angular-editor/commit/1b6ee6763ccc93cf0ddd4ab47380166b5efb8f5e
- [fix] Release notes: github.com https://github.com/kolkov/angular-editor/releases/tag/v3.0.4

## From the sources

@kolkov/angular-editor before 3.0.4 contains a cross-site scripting vulnerability in toggleEditorMode() that assigns source view text to innerHTML without DomSanitizer sanitization. Attackers can induce users to paste HTML with event handlers such as img onerror into source mode, executing script in the application's origin when toggling views.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_