CVE-2025-71464

@kolkov/angular-editor before 3.0.4 XSS via toggleEditorMode()

Published Nov 14, 2026 CVSS 4.0 · 5.3 Medium EPSS n/a KEV · Not listed

Description

@kolkov/angular-editor before 3.0.4 contains a cross-site scripting vulnerability in toggleEditorMode() that assigns source view text to innerHTML without DomSanitizer sanitization. Attackers can induce users to paste HTML with event handlers such as img onerror into source mode, executing script in the application's origin when toggling views.

Analysis

Technical impact

The vulnerability allows a cross‑site scripting flaw by assigning user‑supplied source view content to a component’s innerHTML without using DomSanitizer. Attackers can craft HTML that includes event attributes such as img onerror, which triggers JavaScript execution in the context of the application when the editor view is toggled.

Affected Systems

Products affected are kolkov:angular-editor prior to version 3.0.4. Any deployment of the Angular Editor library before that release is vulnerable; no additional vendor or product names are listed.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate severity. Exploitation requires a user to paste malicious HTML into the editor’s source view and then trigger a view toggle. The EPSS score is not available, and the issue is not listed in CISA’s KEV catalog, suggesting low to moderate likelihood of widespread exploitation but still requires attention, especially in applications exposed to untrusted input.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

kolkov

angular-editor

unaffected

Version	Status	Constraints
`0`	affected	< 3.0.4
`3.0.4`	unaffected	—

No data.

No data available yet.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade Angular Editor to version 3.0.4 or later.
If an upgrade is not possible, sanitize the source view content before assigning it to innerHTML, for example by using Angular’s DomSanitizer or a third‑party sanitizer to strip event attributes and script tags.
If neither upgrade nor sanitization is feasible, restrict or disable the toggleEditorMode() function in the application, and consider applying a content‑security‑policy to block inline script execution.

Generated by OpenCVE AI on November 14, 2026 at 19:59 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction Passive

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact Low

Subsequent System Integrity Impact Low

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://github.com/kolkov/angular-editor
https://github.com/kolkov/angular-editor/blob/a56cc1672e29f058f1b28dba3f532b4040b56439/projects/angular-editor/src/lib/editor/angular-editor.component.ts#L354-L361
https://github.com/kolkov/angular-editor/commit/1b6ee6763ccc93cf0ddd4ab47380166b5efb8f5e
https://github.com/kolkov/angular-editor/issues/580
https://github.com/kolkov/angular-editor/pull/587
https://github.com/kolkov/angular-editor/releases/tag/v3.0.4
https://www.vulncheck.com/advisories/kolkov-angular-editor-before-3.0.4-xss-via-toggleeditormode

History

Nov 14, 2026 12:45 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		@kolkov/angular-editor before 3.0.4 contains a cross-site scripting vulnerability in toggleEditorMode() that assigns source view text to innerHTML without DomSanitizer sanitization. Attackers can induce users to paste HTML with event handlers such as img onerror into source mode, executing script in the application's origin when toggling views.
Title		@kolkov/angular-editor before 3.0.4 XSS via toggleEditorMode()
Weaknesses		CWE-79
References		https://github.com/kolkov/angular-editor https://github.com/kolkov/angular-editor/blob/a56cc1672e29f058f1b28dba3f532b4040b56439/projects/angular-editor/src/lib/editor/angular-editor.component.ts#L354-L361 https://github.com/kolkov/angular-editor/commit/1b6ee6763ccc93cf0ddd4ab47380166b5efb8f5e https://github.com/kolkov/angular-editor/issues/580 https://github.com/kolkov/angular-editor/pull/587 https://github.com/kolkov/angular-editor/releases/tag/v3.0.4 https://www.vulncheck.com/advisories/kolkov-angular-editor-before-3.0.4-xss-via-toggleeditormode
Metrics		cvssV3_1 `{'score': 6.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}` cvssV4_0 `{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N'}`