AIKIDO-2025-10836

TL;DR

Affected versions of this package are vulnerable to an XSS vulnerability when setting editor value via writeValue(), where the refreshView() method unsafely sets innerHTML without sanitization, bypassing the sanitize: true configuration and allowing XSS payloads to execute; this affects all programmatic value setting methods, including ngModel binding, FormControl setValue/patchValue, and direct property assignment. An attacker can exploit this vulnerability by inserting a malicious payload into the editor and toggling the preview mode, which can trigger the execution of JavaScript code.