Threats tagged 'ghsa-hg4v-phgx-rfj7'

@kolkov/angular-editor versions before 3.0.3 have a cross-site scripting (XSS) vulnerability in the refreshView() function. This function writes HTML from ngModel or reactive form controls directly to innerHTML without using Angular's DomSanitizer, bypassing the default sanitization. An attacker can inject HTML containing event-handler attributes that execute scripts in the application's origin when loaded into the editor.