CVE-2025-71464

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-71464
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-71464.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-71464
Published
2026-11-14T12:32:57Z
Modified
2026-11-15T02:45:29Z
Severity
  • 5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N CVSS Calculator
Summary
@kolkov/angular-editor before 3.0.4 XSS via toggleEditorMode()
Details

@kolkov/angular-editor before 3.0.4 contains a cross-site scripting vulnerability in toggleEditorMode() that assigns source view text to innerHTML without DomSanitizer sanitization. Attackers can induce users to paste HTML with event handlers such as img onerror into source mode, executing script in the application's origin when toggling views.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-79"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/71xxx/CVE-2025-71464.json"
}
References

Affected packages

Git / github.com/kolkov/angular-editor

Affected ranges

Type
GIT
Repo
https://github.com/kolkov/angular-editor
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
4fa6521012267b25b9b5d0fb5ee08a6d8f0af92f
Fixed
1b6ee6763ccc93cf0ddd4ab47380166b5efb8f5e
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "3.0.4"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandardRange"
        },
        {
            "range": [
                {
                    "fixed": "1b6ee6763ccc93cf0ddd4ab47380166b5efb8f5e"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "original_tag": "v3.0.4",
            "range": [
                {
                    "fixed": "4fa6521012267b25b9b5d0fb5ee08a6d8f0af92f"
                }
            ],
            "source": "REFERENCES_TAG"
        }
    ]
}

Affected versions

2.*
2.2.0-beta.0
v0.*
v0.1.0
v0.1.1
v0.10.0
v0.10.4
v0.10.5
v0.10.6
v0.10.7
v0.11.0
v0.11.1
v0.11.2
v0.11.3
v0.12.0
v0.12.1
v0.12.2
v0.12.3
v0.12.4
v0.12.5
v0.13.0
v0.13.1
v0.15.0
v0.15.1
v0.15.2
v0.15.3
v0.15.4
v0.16.0
v0.16.1
v0.16.2
v0.17.0
v0.17.1
v0.17.2
v0.17.3
v0.18.0
v0.18.1
v0.18.2
v0.18.3
v0.18.4
v0.2.0
v0.3.1
v0.3.2
v0.3.3
v0.3.4
v0.4.0
v0.4.1
v0.5.0
v0.6.1
v0.7.0
v0.8.0
v0.8.6
v0.9.0
v1.*
v1.0.0-beta.0
v1.0.0-beta.1
v1.0.0-beta.2
v1.0.0-beta.4
v1.0.0-beta.5
v1.0.0-beta.6
v1.1.6
v1.1.7
v1.1.8
v1.2.0
v2.*
v2.0.0
v2.0.1
v2.1.0
v2.2.0-beta.0
v3.*
v3.0.0-beta.0
v3.0.0-beta.1
v3.0.0-beta.2
v3.0.0-beta.3
v3.0.1
v3.0.2
v3.0.3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-71464.json"