Search

Find a vulnerability

Search criteria

    4 vulnerabilities found for angular-editor by kolkov

    CVE-2025-71465 (GCVE-0-2025-71465)

    Vulnerability from nvd – Published: 2026-11-14 12:32 – Updated: 2026-11-14 12:32
    VLAI
    Title
    @kolkov/angular-editor before 3.0.3 XSS via refreshView()
    Summary
    @kolkov/angular-editor before 3.0.3 contains a cross-site scripting vulnerability in refreshView() that writes HTML from ngModel or reactive form controls to innerHTML without DomSanitizer, bypassing the default sanitize option. Attackers can store HTML with event-handler attributes in content later loaded into the editor to execute script in the application's origin for users opening it.
    Severity
    5.3 (Medium)
    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
    6.1 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    CWE
    • CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
    Assigner
    VulnCheck CNA under the mitre root
    CNA scorecard B 84/100 over 8179 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    kolkov angular-editor Affected: 0 , < 3.0.3 (semver)
    Unaffected: 3.0.3 (semver)
    		Create a notification for this product.
    Date Public
    2025-04-10 00:00
    Credits
    Mario Tesoro kolkov
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:npm/%40kolkov/angular-editor",
          "product": "angular-editor",
          "vendor": "kolkov",
          "versions": [
            {
              "lessThan": "3.0.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "3.0.3",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Mario Tesoro"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "kolkov"
        }
      ],
      "datePublic": "2025-04-10T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "@kolkov/angular-editor before 3.0.3 contains a cross-site scripting vulnerability in refreshView() that writes HTML from ngModel or reactive form controls to innerHTML without DomSanitizer, bypassing the default sanitize option. Attackers can store HTML with event-handler attributes in content later loaded into the editor to execute script in the application\u0027s origin for users opening it."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "LOW",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-14T12:32:56.793Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Issue #580",
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/kolkov/angular-editor/issues/580"
        },
        {
          "name": "Patch Commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/kolkov/angular-editor/commit/774a97d0b30e257a07c5d426548c9b900c8a8975"
        },
        {
          "name": "Unsanitized innerHTML in refreshView at v3.0.2",
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/kolkov/angular-editor/blob/a74a9b1900a0ecbfefbb701d7c272171101ff454/projects/angular-editor/src/lib/editor/angular-editor.component.ts#L276-L278"
        },
        {
          "name": "angular-editor v3.0.3 Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/kolkov/angular-editor/releases/tag/v3.0.3"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/kolkov/angular-editor"
        },
        {
          "name": "VulnCheck Advisory: @kolkov/angular-editor before 3.0.3 XSS via refreshView()",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/kolkov-angular-editor-before-3.0.3-xss-via-refreshview"
        }
      ],
      "title": "@kolkov/angular-editor before 3.0.3 XSS via refreshView()",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2025-71465",
    "datePublished": "2026-11-14T12:32:56.793Z",
    "dateReserved": "2026-11-14T12:15:40.062Z",
    "dateUpdated": "2026-11-14T12:32:56.793Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2025-71464 (GCVE-0-2025-71464)

    Vulnerability from nvd – Published: 2026-11-14 12:32 – Updated: 2026-11-14 12:32
    VLAI
    Title
    @kolkov/angular-editor before 3.0.4 XSS via toggleEditorMode()
    Summary
    @kolkov/angular-editor before 3.0.4 contains a cross-site scripting vulnerability in toggleEditorMode() that assigns source view text to innerHTML without DomSanitizer sanitization. Attackers can induce users to paste HTML with event handlers such as img onerror into source mode, executing script in the application's origin when toggling views.
    Severity
    5.3 (Medium)
    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
    6.1 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    CWE
    • CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
    Assigner
    VulnCheck CNA under the mitre root
    CNA scorecard B 84/100 over 8179 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    kolkov angular-editor Affected: 0 , < 3.0.4 (semver)
    Unaffected: 3.0.4 (semver)
    		Create a notification for this product.
    Date Public
    2025-04-10 00:00
    Credits
    Mario Tesoro Mario Tesoro
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:npm/%40kolkov/angular-editor",
          "product": "angular-editor",
          "vendor": "kolkov",
          "versions": [
            {
              "lessThan": "3.0.4",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "3.0.4",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Mario Tesoro"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Mario Tesoro"
        }
      ],
      "datePublic": "2025-04-10T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "@kolkov/angular-editor before 3.0.4 contains a cross-site scripting vulnerability in toggleEditorMode() that assigns source view text to innerHTML without DomSanitizer sanitization. Attackers can induce users to paste HTML with event handlers such as img onerror into source mode, executing script in the application\u0027s origin when toggling views."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "LOW",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-14T12:32:57.503Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Issue #580",
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/kolkov/angular-editor/issues/580"
        },
        {
          "tags": [
            "issue-tracking",
            "patch"
          ],
          "url": "https://github.com/kolkov/angular-editor/pull/587"
        },
        {
          "name": "Patch Commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/kolkov/angular-editor/commit/1b6ee6763ccc93cf0ddd4ab47380166b5efb8f5e"
        },
        {
          "name": "Unsanitized innerHTML in toggleEditorMode at v3.0.3",
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/kolkov/angular-editor/blob/a56cc1672e29f058f1b28dba3f532b4040b56439/projects/angular-editor/src/lib/editor/angular-editor.component.ts#L354-L361"
        },
        {
          "name": "angular-editor v3.0.4 Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/kolkov/angular-editor/releases/tag/v3.0.4"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/kolkov/angular-editor"
        },
        {
          "name": "VulnCheck Advisory: @kolkov/angular-editor before 3.0.4 XSS via toggleEditorMode()",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/kolkov-angular-editor-before-3.0.4-xss-via-toggleeditormode"
        }
      ],
      "title": "@kolkov/angular-editor before 3.0.4 XSS via toggleEditorMode()",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2025-71464",
    "datePublished": "2026-11-14T12:32:57.503Z",
    "dateReserved": "2026-11-14T12:15:39.710Z",
    "dateUpdated": "2026-11-14T12:32:57.503Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2025-71464 (GCVE-0-2025-71464)

    Vulnerability from cvelistv5 – Published: 2026-11-14 12:32 – Updated: 2026-11-14 12:32
    VLAI
    Title
    @kolkov/angular-editor before 3.0.4 XSS via toggleEditorMode()
    Summary
    @kolkov/angular-editor before 3.0.4 contains a cross-site scripting vulnerability in toggleEditorMode() that assigns source view text to innerHTML without DomSanitizer sanitization. Attackers can induce users to paste HTML with event handlers such as img onerror into source mode, executing script in the application's origin when toggling views.
    Severity
    5.3 (Medium)
    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
    6.1 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    CWE
    • CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
    Assigner
    VulnCheck CNA under the mitre root
    CNA scorecard B 84/100 over 8179 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    kolkov angular-editor Affected: 0 , < 3.0.4 (semver)
    Unaffected: 3.0.4 (semver)
    		Create a notification for this product.
    Date Public
    2025-04-10 00:00
    Credits
    Mario Tesoro Mario Tesoro
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:npm/%40kolkov/angular-editor",
          "product": "angular-editor",
          "vendor": "kolkov",
          "versions": [
            {
              "lessThan": "3.0.4",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "3.0.4",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Mario Tesoro"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Mario Tesoro"
        }
      ],
      "datePublic": "2025-04-10T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "@kolkov/angular-editor before 3.0.4 contains a cross-site scripting vulnerability in toggleEditorMode() that assigns source view text to innerHTML without DomSanitizer sanitization. Attackers can induce users to paste HTML with event handlers such as img onerror into source mode, executing script in the application\u0027s origin when toggling views."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "LOW",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-14T12:32:57.503Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Issue #580",
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/kolkov/angular-editor/issues/580"
        },
        {
          "tags": [
            "issue-tracking",
            "patch"
          ],
          "url": "https://github.com/kolkov/angular-editor/pull/587"
        },
        {
          "name": "Patch Commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/kolkov/angular-editor/commit/1b6ee6763ccc93cf0ddd4ab47380166b5efb8f5e"
        },
        {
          "name": "Unsanitized innerHTML in toggleEditorMode at v3.0.3",
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/kolkov/angular-editor/blob/a56cc1672e29f058f1b28dba3f532b4040b56439/projects/angular-editor/src/lib/editor/angular-editor.component.ts#L354-L361"
        },
        {
          "name": "angular-editor v3.0.4 Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/kolkov/angular-editor/releases/tag/v3.0.4"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/kolkov/angular-editor"
        },
        {
          "name": "VulnCheck Advisory: @kolkov/angular-editor before 3.0.4 XSS via toggleEditorMode()",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/kolkov-angular-editor-before-3.0.4-xss-via-toggleeditormode"
        }
      ],
      "title": "@kolkov/angular-editor before 3.0.4 XSS via toggleEditorMode()",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2025-71464",
    "datePublished": "2026-11-14T12:32:57.503Z",
    "dateReserved": "2026-11-14T12:15:39.710Z",
    "dateUpdated": "2026-11-14T12:32:57.503Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2025-71465 (GCVE-0-2025-71465)

    Vulnerability from cvelistv5 – Published: 2026-11-14 12:32 – Updated: 2026-11-14 12:32
    VLAI
    Title
    @kolkov/angular-editor before 3.0.3 XSS via refreshView()
    Summary
    @kolkov/angular-editor before 3.0.3 contains a cross-site scripting vulnerability in refreshView() that writes HTML from ngModel or reactive form controls to innerHTML without DomSanitizer, bypassing the default sanitize option. Attackers can store HTML with event-handler attributes in content later loaded into the editor to execute script in the application's origin for users opening it.
    Severity
    5.3 (Medium)
    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
    6.1 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    CWE
    • CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
    Assigner
    VulnCheck CNA under the mitre root
    CNA scorecard B 84/100 over 8179 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    kolkov angular-editor Affected: 0 , < 3.0.3 (semver)
    Unaffected: 3.0.3 (semver)
    		Create a notification for this product.
    Date Public
    2025-04-10 00:00
    Credits
    Mario Tesoro kolkov
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:npm/%40kolkov/angular-editor",
          "product": "angular-editor",
          "vendor": "kolkov",
          "versions": [
            {
              "lessThan": "3.0.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "3.0.3",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Mario Tesoro"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "kolkov"
        }
      ],
      "datePublic": "2025-04-10T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "@kolkov/angular-editor before 3.0.3 contains a cross-site scripting vulnerability in refreshView() that writes HTML from ngModel or reactive form controls to innerHTML without DomSanitizer, bypassing the default sanitize option. Attackers can store HTML with event-handler attributes in content later loaded into the editor to execute script in the application\u0027s origin for users opening it."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "LOW",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-14T12:32:56.793Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Issue #580",
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/kolkov/angular-editor/issues/580"
        },
        {
          "name": "Patch Commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/kolkov/angular-editor/commit/774a97d0b30e257a07c5d426548c9b900c8a8975"
        },
        {
          "name": "Unsanitized innerHTML in refreshView at v3.0.2",
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/kolkov/angular-editor/blob/a74a9b1900a0ecbfefbb701d7c272171101ff454/projects/angular-editor/src/lib/editor/angular-editor.component.ts#L276-L278"
        },
        {
          "name": "angular-editor v3.0.3 Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/kolkov/angular-editor/releases/tag/v3.0.3"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/kolkov/angular-editor"
        },
        {
          "name": "VulnCheck Advisory: @kolkov/angular-editor before 3.0.3 XSS via refreshView()",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/kolkov-angular-editor-before-3.0.3-xss-via-refreshview"
        }
      ],
      "title": "@kolkov/angular-editor before 3.0.3 XSS via refreshView()",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2025-71465",
    "datePublished": "2026-11-14T12:32:56.793Z",
    "dateReserved": "2026-11-14T12:15:40.062Z",
    "dateUpdated": "2026-11-14T12:32:56.793Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}