Executive brief
textAngular is a rich text editor component for Angular.js applications. A cross-site scripting (XSS) vulnerability allows attackers to inject malicious code if a user copies and pastes specially crafted content into the editor, potentially enabling account takeover or data theft. The vulnerability affects all versions up to 1.5.16, and no patch is currently available.
Technical details
textAngular contains a stored/reflected cross-site scripting (CWE-79) vulnerability in its copy-paste handling mechanism. The vulnerability exists in versions 1.5.16 and earlier, where the editor fails to properly sanitize HTML content during paste operations. An attacker can craft a malicious payload that, when copied and pasted by a user into the editor, executes arbitrary JavaScript in the victim's browser context with access to the application's data and session. The attack requires user interaction (copy-paste action) and is network-accessible via a malicious web page or document. No official patch is documented as available.
Affected products
- textAngular textAngular 1.5.16 and prior
Timeline
- 2023-02-21: disclosed
- 2023-02-21: advisory