Quill is vulnerable to XSS via HTML export feature

Description

A lack of data validation vulnerability in the HTML export feature in Quill in allows Cross-Site Scripting (XSS).

This issue affects Quill: 2.0.3.

Recommendation

No fix is available yet. Followings are affected versions:

• = 2.0.3

References

• GHSA-v3m3-f69x-jf25
• fluidattacks.com
• CVE-2025-15056
• CWE-74
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Cross-site Scripting (XSS) in serialize-javascript - CVE-2024-11831
• SillyTavern Web Interface Vulnerable DNS Rebinding - CVE-2025-59159
• Prototype Pollution in lodash (GHSA-p6mc-m468-83gw) - CVE-2020-8203
• Better Call routing bug can lead to Cache Deception - Vulnerability

Tags:

npm

quill