CVE-2025-61261: Angular

Medium severity, CVSS 5.4. EPSS: 0.3% chance of exploitation in the next 30 days.

A reflected cross-site scripting (XSS) vulnerability in CKeditor v46.1.0 & Angular v18.0.0 allows attackers to execute arbitrary code in the context of a user's browser via injecting a crafted payload.

Affected products

• Angular Angular: version 18.0.0 only
• Ckeditor CKEDITOR5: version 46.1.0 only

Published 2025-11-07. Last modified 2026-06-17.