textAngular Copy-Paste Cross-Site Scripting Vulnerability

A copy-paste cross-site scripting (XSS) vulnerability has been identified in the textAngular editor for Angular.js, affecting versions through 1.5.16. This vulnerability requires the victim to be tricked into pasting a malicious payload into the editor.

Impact

Exploitation of this vulnerability can lead to cross-site scripting, where an attacker can inject malicious scripts that are executed in the context of the user's browser.

Reproduction

To reproduce this vulnerability, paste a crafted HTML payload, such as an image tag with JavaScript event handlers, into the textAngular editor. This can be done by copying the payload from a controlled environment, such as a local HTML file or a web page that allows JavaScript execution, and then pasting it into the textAngular editor.