Cross-Site Scripting Vulnerability in Kolkov Angular Editor

CVE-2025-71465

What is CVE-2025-71465?

The Angular Editor from Kolkov prior to version 3.0.3 is susceptible to a cross-site scripting vulnerability due to improper handling of user-supplied HTML. Specifically, the 'refreshView()' function uses innerHTML to render content that may include event-handler attributes, without applying necessary sanitization through DomSanitizer. This oversight allows malicious actors to inject harmful scripts into the editor, which can then be executed in the context of the application's origin when users access the affected content. The vulnerability poses significant security risks like data theft or session hijacking if exploited.

References