Threats affecting pkg:npm/angular-editor

CVE-2025-71464 is a cross-site scripting (XSS) vulnerability in the kolkov/angular-editor component before version 3.0.4. The flaw occurs in the toggleEditorMode() function, which assigns source view text directly to innerHTML without proper sanitization using Angular's DomSanitizer. This allows attackers to craft HTML containing event handlers (e.g., img onerror) that execute scripts in the application's origin when users toggle between editor views.

CVE-2025-71465 is a cross-site scripting (XSS) vulnerability in the kolkov/angular-editor component before version 3.0.3. The vulnerability arises because the refreshView() function writes HTML content from ngModel or reactive form controls directly to innerHTML without using Angular's DomSanitizer, bypassing default sanitization. This allows attackers to inject HTML with event-handler attributes that execute scripts in the application's origin when loaded in the editor. The issue is fixed in version 3.0.3.