AIKIDO-2025-10836
@kolkov/angular-editor is vulnerable to Cross-Site Scripting (XSS)
71
High Risk
This Affects:
@kolkov/angular-editorTL;DR
Affected versions of this package are vulnerable to an XSS vulnerability when setting editor value via writeValue(), where the refreshView() method unsafely sets innerHTML without sanitization, bypassing the sanitize: true configuration and allowing XSS payloads to execute; this affects all programmatic value setting methods, including ngModel binding, FormControl setValue/patchValue, and direct property assignment. An attacker can exploit this vulnerability by inserting a malicious payload into the editor and toggling the preview mode, which can trigger the execution of JavaScript code.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
@kolkov/angular-editor is vulnerable to Cross-Site Scripting (XSS) in versions 0.1.0 - 3.0.2.
How to fix this
Upgrade the @kolkov/angular-editor library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.