CVE-2025-71465 in angular-editor
Summary
by MITRE • 11/14/2026
@kolkov/angular-editor before 3.0.3 contains a cross-site scripting vulnerability in refreshView() that writes HTML from ngModel or reactive form controls to innerHTML without DomSanitizer, bypassing the default sanitize option. Attackers can store HTML with event-handler attributes in content later loaded into the editor to execute script in the application's origin for users opening it.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 11/14/2026
The vulnerability identified in @kolkov/angular-editor prior to version 3.0.3 represents a critical security flaw rooted in improper neutralization of user input within client-side web applications. Specifically, the issue resides in the refreshView function, which is responsible for rendering content into the editor interface. The core technical deficiency involves writing HTML data directly from Angular ngModel bindings or reactive form controls to the innerHTML property without employing a sanitization mechanism such as DomSanitizer. In modern frontend frameworks like Angular, direct assignment to innerHTML bypasses built-in security filters that are typically applied when using standard binding directives. This architectural oversight allows raw, unvalidated HTML content to be injected directly into the Document Object Model, creating an environment where malicious scripts can execute with the privileges of the application's origin.
This flaw aligns closely with CWE-79, known as Improper Neutralization of Input During Web Page Generation commonly referred to as Cross-site Scripting (XSS). The specific nature of this vulnerability is classified as Stored XSS because attackers do not need to trick a user into clicking a malicious link in real-time. Instead, they can store HTML containing event-handler attributes or script tags within the content that is later loaded and rendered by the editor. When another user opens this compromised content within the application, the browser interprets the injected code as part of the trusted page context. This execution occurs entirely on the client side but leverages the trust relationship between the user's session and the vulnerable web application.
The operational impact of this vulnerability is severe due to its ability to bypass default security configurations. By circumventing the sanitize option, attackers can execute arbitrary JavaScript code in the context of the victim's browser. This capability enables a wide range of malicious activities including session hijacking through cookie theft, credential harvesting via keyloggers or form injection, defacement of application content, and potentially pivoting to further attacks against internal network resources if the application has access to sensitive backend services. The persistence of this threat means that any user interacting with stored data becomes a potential victim without their knowledge or consent, undermining the integrity and confidentiality assurances provided by the web application.
To mitigate this vulnerability, developers must upgrade immediately to version 3.0.3 or later where these sanitization gaps have been addressed. For applications unable to update instantly, implementing manual sanitization is critical. This involves using Angular's DomSanitizer service to explicitly mark trusted HTML before binding it to innerHTML properties. Developers should also audit all instances of direct DOM manipulation and ensure that user-supplied data is validated against a strict allowlist of permitted tags and attributes rather than relying on implicit framework behaviors. Additionally, implementing Content Security Policy headers can provide an additional layer of defense by restricting the sources from which scripts are allowed to execute, thereby limiting the impact even if some injection attempts succeed.