{"id":"CVE-2025-71465","kind":"vulnerability","aliases":["CVE-2025-71465"],"related":[],"title":"angular-editor: stored XSS via refreshView() bypasses sanitizer","description":"@kolkov/angular-editor before 3.0.3 contains a cross-site scripting vulnerability in refreshView() that writes HTML from ngModel or reactive form controls to innerHTML without DomSanitizer, bypassing the default sanitize option. Attackers can store HTML with event-handler attributes in content later loaded into the editor to execute script in the application's origin for users opening it.","summary":"@kolkov/angular-editor before 3.0.3 writes HTML from ngModel or reactive form controls straight to innerHTML, skipping the DomSanitizer and the default sanitize option. An attacker who stores HTML with event-handler attributes can run script in the origin of any user who opens that content in the editor.","severity":"medium","cvss":6.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["angular","frontend","npm","package"],"not_affected_if":["no-untrusted-html","sanitized-input"],"how_to_check":"- Check the installed version of `@kolkov/angular-editor` in `package.json` and the lockfile.\n- Search the codebase for places that bind `ngModel` or reactive form controls to the editor and load stored content into it.","fix":"- `@kolkov/angular-editor` 3.0.3 or later (per the sources' fixed version).","status":"open","published_at":"2026-11-14T13:17:20+00:00","first_seen_at":"2026-11-14T13:28:09+00:00","triaged_at":"2026-11-14T13:29:06+00:00","updated_at":"2026-11-14T13:29:06+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-14T13:29:06Z","model":"claude-haiku-5-5","output":{"fix":"- `@kolkov/angular-editor` 3.0.3 or later (per the sources' fixed version).","reach":"internet","title":"angular-editor: stored XSS via refreshView() bypasses sanitizer","impact":"medium","summary":"@kolkov/angular-editor before 3.0.3 writes HTML from ngModel or reactive form controls straight to innerHTML, skipping the DomSanitizer and the default sanitize option. An attacker who stores HTML with event-handler attributes can run script in the origin of any user who opens that content in the editor.","audience":"developers","category":"package","nicknames":[],"who_cares":["angular","npm","frontend"],"confidence":0.7,"fix_status":"available","needs_auth":"unknown","worst_case":"script runs in users' browser sessions within the app origin","analyst_note":"","how_to_check":"- Check the installed version of `@kolkov/angular-editor` in `package.json` and the lockfile.\n- Search the codebase for places that bind `ngModel` or reactive form controls to the editor and load stored content into it.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["no-untrusted-html","sanitized-input"],"who_is_affected":"Angular applications that use @kolkov/angular-editor and load user-supplied or stored HTML into it through ngModel or reactive forms are exposed. Apps that never store or reload untrusted HTML through the editor, or that sanitize content before it reaches the model, are less exposed. The sources do not say whether the sanitize option being on by default changes exposure for every setup.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000762,"input_tokens":4639,"output_tokens":596,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2025':11A,14A '-71465':12A,15A '3.0.3':22B,70C 'angular':2A,16B 'angular-editor':1A 'applic':119C 'attack':43B,98C 'attribut':51B,106C 'bypass':8A,93C 'contain':71C 'content':64B,108C 'control':30B,88C 'cross':74C 'cross-sit':73C 'cve':10A,13A 'default':39B,95C 'domsanit':36B,92C 'editor':3A,67B,113C 'event':49B,104C 'event-handl':48B,103C 'execut':115C 'form':29B,87C 'frontend':17B 'handler':50B,105C 'html':24B,46B,82C,101C 'innerhtml':33B,90C 'kolkov/angular-editor':20B,68C 'later':109C 'load':110C 'ngmodel':26B,84C 'npm':18B 'open':62B,124C 'option':41B,97C 'origin':57B,121C 'packag':19B 'reactiv':28B,86C 'refreshview':7A,79C 'run':53B 'sanit':9A,40B,96C 'script':54B,76C,116C 'site':75C 'skip':34B 'store':4A,45B,100C 'straight':31B 'user':60B,123C 'via':6A 'vulner':77C 'without':91C 'write':23B,81C 'xss':5A","nicknames":[],"mitigations":[],"who_affected":"Angular applications that use @kolkov/angular-editor and load user-supplied or stored HTML into it through ngModel or reactive forms are exposed. Apps that never store or reload untrusted HTML through the editor, or that sanitize content before it reaches the model, are less exposed. The sources do not say whether the sanitize option being on by default changes exposure for every setup.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["angular","frontend","medium","npm","package"],"campaign_type":null,"search_a":"'-2025':11A,14A '-71465':12A,15A 'angular':2A 'angular-editor':1A 'bypass':8A 'cve':10A,13A 'editor':3A 'refreshview':7A 'sanit':9A 'store':4A 'via':6A 'xss':5A","search_b":"'3.0.3':22B 'angular':16B 'attack':43B 'attribut':51B 'content':64B 'control':30B 'default':39B 'domsanit':36B 'editor':67B 'event':49B 'event-handl':48B 'form':29B 'frontend':17B 'handler':50B 'html':24B,46B 'innerhtml':33B 'kolkov/angular-editor':20B 'ngmodel':26B 'npm':18B 'open':62B 'option':41B 'origin':57B 'packag':19B 'reactiv':28B 'run':53B 'sanit':40B 'script':54B 'skip':34B 'store':45B 'straight':31B 'user':60B 'write':23B","search_c":"'3.0.3':70C 'applic':119C 'attack':98C 'attribut':106C 'bypass':93C 'contain':71C 'content':108C 'control':88C 'cross':74C 'cross-sit':73C 'default':95C 'domsanit':92C 'editor':113C 'event':104C 'event-handl':103C 'execut':115C 'form':87C 'handler':105C 'html':82C,101C 'innerhtml':90C 'kolkov/angular-editor':68C 'later':109C 'load':110C 'ngmodel':84C 'open':124C 'option':97C 'origin':121C 'reactiv':86C 'refreshview':79C 'sanit':96C 'script':76C,116C 'site':75C 'store':100C 'user':123C 'vulner':77C 'without':91C 'write':81C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-14T13:17:20+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2025-71465","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71465","severity":null,"published_at":"2026-11-14T13:17:20+00:00","modified_at":"2026-11-14T13:17:20+00:00","first_seen_at":"2026-11-14T13:28:09+00:00","fetched_at":"2026-11-14T13:28:09+00:00","note":null}],"documents":[{"id":155832,"url":"https://github.com/kolkov/angular-editor/commit/774a97d0b30e257a07c5d426548c9b900c8a8975","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":155833,"url":"https://github.com/kolkov/angular-editor/releases/tag/v3.0.3","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":155834,"url":"https://www.vulncheck.com/advisories/kolkov-angular-editor-before-3.0.3-xss-via-refreshview","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}