CVE-2025-71464: @kolkov/angular-editor before 3.0.4 XSS via toggleEditorMode()

Q: Who is exposed to this issue?

Applications using @kolkov/angular-editor versions before 3.0.4 are exposed when users can access source mode and can be induced to paste attacker-controlled HTML into it.

Q: What must an attacker do to exploit it?

The attacker must persuade a user to paste HTML containing an event handler, such as an img onerror handler, into source mode. Script executes in the application's origin when the user toggles between editor views.

Q: Is user interaction required?

Yes. Exploitation requires a user to paste the malicious HTML into source mode and toggle the editor view.

Q: What version addresses the issue?

Upgrade @kolkov/angular-editor to version 3.0.4 or later. The vulnerable versions are those before 3.0.4.

Published Nov 14, 2026

Updated

@kolkov/angular-editor before 3.0.4 contains a cross-site scripting vulnerability in toggleEditorMode() that assigns source view text to innerHTML without DomSanitizer sanitization. Attackers can induce users to paste HTML with event handlers such as img onerror into source mode, executing script in the application's origin when toggling views.

Affected Software

1 affected component

npm/@kolkov/angular-editor<3.0.4

Event History

Nov 14, 2026

CVE Published

via MITRE·12:32 PM

Data Sourced

via MITRE·12:32 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·01:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

Applications using @kolkov/angular-editor versions before 3.0.4 are exposed when users can access source mode and can be induced to paste attacker-controlled HTML into it.

What must an attacker do to exploit it?

The attacker must persuade a user to paste HTML containing an event handler, such as an img onerror handler, into source mode. Script executes in the application's origin when the user toggles between editor views.

Is user interaction required?

Yes. Exploitation requires a user to paste the malicious HTML into source mode and toggle the editor view.

What version addresses the issue?

Upgrade @kolkov/angular-editor to version 3.0.4 or later. The vulnerable versions are those before 3.0.4.

CVE-2025-71464: @kolkov/angular-editor before 3.0.4 XSS via toggleEditorMode()

Affected Software

Event History

Frequently Asked Questions

Who is exposed to this issue?

What must an attacker do to exploit it?

Is user interaction required?

What version addresses the issue?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What must an attacker do to exploit it?

Is user interaction required?

What version addresses the issue?