Reverse Tabnabbing in quill

Description

Versions of quill prior to 1.3.7 are vulnerable to Reverse Tabnabbing. The package uses target='_blank' in anchor tags, allowing attackers to access window.opener for the original page when opening links. This is commonly used for phishing attacks.

Recommendation

Update the quill package to the latest compatible version. Followings are version details:

• Affected version(s): < 1.3.7
• Patched version(s): 1.3.7

References

• GHSA-588m-9qg5-35pq
• www.npmjs.com
• CWE-1022

Related Issues

• Reverse Tabnabbing in showdown - Vulnerability
• Reverse Tabnapping in swagger-ui - Vulnerability
• jsdiff has a Denial of Service vulnerability in parsePatch and applyPatch - CVE-2026-24001
• Incorrect default cookie name and recommendation - Vulnerability

Tags:

npm

quill