CVE-2025-71465 · Package
NO FIX YET · SEE WHAT TO DO
@kolkov/angular-editor before 3.0.3 writes HTML from ngModel or reactive form controls straight to innerHTML, skipping the DomSanitizer and the default sanitize option. An attacker who stores HTML with event-handler attributes can run script in the origin of any user who opens that content in the editor.
first public Nov 14, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Angular applications that use @kolkov/angular-editor and load user-supplied or stored HTML into it through ngModel or reactive forms are exposed. Apps that never store or reload untrusted HTML through the editor, or that sanitize content before it reaches the model, are less exposed. The sources do not say whether the sanitize option being on by default changes exposure for every setup.
Not affected if no-untrusted-html, sanitized-input
Who cares angular, frontend, npm
@kolkov/angular-editor in package.json and the lockfile.ngModel or reactive form controls to the editor and load stored content into it.@kolkov/angular-editor 3.0.3 or later (per the sources' fixed version).@kolkov/angular-editor before 3.0.3 contains a cross-site scripting vulnerability in refreshView() that writes HTML from ngModel or reactive form controls to innerHTML without DomSanitizer, bypassing the default sanitize option. Attackers can store HTML with event-handler attributes in content later loaded into the editor to execute script in the application's origin for users opening it.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.