GitHub Advisoryadvisory · npm

GHSA-4943-9vgg-gr5r Cross-site Scripting in quill

MEDIUM Published 2021-05-10 Modified 2024-08-09 Official page ↗
Aliases
CVE-2021-3163
Ecosystem
npm
Packages
quill
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2021-05-07

Affected packages

• npm quill: <= 1.3.7 (no fix yet)

Description

A vulnerability in the HTML editor of Slab Quill allows an attacker to execute arbitrary JavaScript by storing an XSS payload (a crafted `onloadstart` attribute of an IMG element) in a text field. No patch exists and no further releases are planned. This CVE is disputed. Researchers have claimed that this issue is not within the product itself, but is intended behavior in a web browser. More information can be found here.

Related

Alias · CVE (1)

  • CVE-2021-3163 A vulnerability in the HTML editor of Slab Quill 4.8.0 allows an attacker to execute arbitrary JavaScript by storing an XSS payload (a… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References