Cross-Site Scripting Vulnerability in Angular Editor by Kolkov

CVE-2025-71464

What is CVE-2025-71464?

The Angular Editor by Kolkov, versions prior to 3.0.4, is susceptible to a cross-site scripting vulnerability in the toggleEditorMode() function. This issue occurs when user-supplied text is assigned to innerHTML without proper sanitization via DomSanitizer. Attackers can exploit this flaw by manipulating users into pasting crafted HTML containing malicious event handlers, such as 'img onerror', into the source mode. When users toggle between views, this can lead to the execution of arbitrary scripts within the application's context.

References