GitHub Advisoryadvisory · npm

GHSA-v3m3-f69x-jf25 Quill is vulnerable to XSS via HTML export feature

LOW Published 2026-01-13 Modified 2026-04-10 Official page ↗
Aliases
CVE-2025-15056
Ecosystem
npm
Packages
quill
Severity
Low
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-74, CWE-79
Reviewed
2026-01-16

Affected packages

• npm quill: 2.0.3 (no fix yet)

Description

A lack of data validation vulnerability in the HTML export feature in Quill in allows Cross-Site Scripting (XSS). This issue affects Quill: 2.0.3.

Related

Alias · CVE (1)

  • CVE-2025-15056 A lack of data validation vulnerability in the HTML export feature in Quill in allows Cross-Site Scripting (XSS). vulnerability

Weakness · CWE (2)

  • CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component weakness
  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References