CVE-2025-71465

@kolkov/angular-editor before 3.0.3 XSS via refreshView()

Published Nov 14, 2026 CVSS 4.0 · 5.3 Medium EPSS n/a KEV · Not listed

Description

@kolkov/angular-editor before 3.0.3 contains a cross-site scripting vulnerability in refreshView() that writes HTML from ngModel or reactive form controls to innerHTML without DomSanitizer, bypassing the default sanitize option. Attackers can store HTML with event-handler attributes in content later loaded into the editor to execute script in the application's origin for users opening it.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

kolkov

angular-editor

unaffected

Version	Status	Constraints
`0`	affected	< 3.0.3
`3.0.3`	unaffected	—

No data.

No data available yet.

Remediation

No solution or workaround provided in the CVE record

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction Passive

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact Low

Subsequent System Integrity Impact Low

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://github.com/kolkov/angular-editor
https://github.com/kolkov/angular-editor/blob/a74a9b1900a0ecbfefbb701d7c272171101ff454/projects/angular-editor/src/lib/editor/angular-editor.component.ts#L276-L278
https://github.com/kolkov/angular-editor/commit/774a97d0b30e257a07c5d426548c9b900c8a8975
https://github.com/kolkov/angular-editor/issues/580
https://github.com/kolkov/angular-editor/releases/tag/v3.0.3
https://www.vulncheck.com/advisories/kolkov-angular-editor-before-3.0.3-xss-via-refreshview

History

Nov 14, 2026 12:45 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		@kolkov/angular-editor before 3.0.3 contains a cross-site scripting vulnerability in refreshView() that writes HTML from ngModel or reactive form controls to innerHTML without DomSanitizer, bypassing the default sanitize option. Attackers can store HTML with event-handler attributes in content later loaded into the editor to execute script in the application's origin for users opening it.
Title		@kolkov/angular-editor before 3.0.3 XSS via refreshView()
Weaknesses		CWE-79
References		https://github.com/kolkov/angular-editor https://github.com/kolkov/angular-editor/blob/a74a9b1900a0ecbfefbb701d7c272171101ff454/projects/angular-editor/src/lib/editor/angular-editor.component.ts#L276-L278 https://github.com/kolkov/angular-editor/commit/774a97d0b30e257a07c5d426548c9b900c8a8975 https://github.com/kolkov/angular-editor/issues/580 https://github.com/kolkov/angular-editor/releases/tag/v3.0.3 https://www.vulncheck.com/advisories/kolkov-angular-editor-before-3.0.3-xss-via-refreshview
Metrics		cvssV3_1 `{'score': 6.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}` cvssV4_0 `{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N'}`