Description
Versions of quill prior to 1.3.7 are vulnerable to Reverse Tabnabbing. The package uses target='_blank' in anchor tags, allowing attackers to access window.opener for the original page when opening links. This is commonly used for phishing attacks.
Recommendation
Update the quill package to the latest compatible version. Followings are version details:
- Affected version(s): < 1.3.7
- Patched version(s): 1.3.7
References
Could your website be exposed too?
SmartScanner can check your website for Reverse Tabnabbing in quill and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Reverse Tabnabbing in showdown - Vulnerability
- Reverse Tabnapping in swagger-ui - Vulnerability
- TypeORM: SQL Injection in UpdateQueryBuilder/SoftDeleteQueryBuilder orderBy (MySQL/MariaDB) - Vulnerability
- Reflected cross-site scripting (XSS) vulnerability - CVE-2022-0087
You might also like:
See something that needs correcting? Let us knowUpdated January 09, 2023