Technical impact
The vulnerability lies in the refreshView() method of the @kolkov/angular-editor library, allowing injected HTML stored in form controls to be written directly to innerHTML without sanitization. This flaw can lead to stored cross‑site scripting that executes arbitrary JavaScript in the context of the application for any user who opens the edited content. The flaw corresponds to CWE‑79, a classic reflected or stored XSS weakness that undermines confidentiality, integrity, and availability of the affected application.
Affected Systems
All installations of kolkov:angular-editor with a version older than 3.0.3 are impacted. The vendor provides a fix in release v3.0.3, which ends the ability of refreshView() to write unsanitized HTML to the DOM. No other affected versions are listed.
Risk and Exploitability
With a CVSS score of 5.3, the vulnerability is of moderate severity. The EPSS score is not publicly available, suggesting limited publicly known exploitation activity. The vulnerability is not listed in CISA’s KEV catalog. Attackers can exploit this flaw by injecting event‑handler attributes into content that will be rendered by the editor; the likely attack vector is a malicious user who can control or influence the data loaded into the editor, enabling stored XSS when other users view or edit that content.
