CVE-2025-15056: Quill XSS Vulnerability in HTML Export Feature
Summary
CVE-2025-15056: Quill is vulnerable to XSS via HTML export feature. Affects quill versions 2.0.3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Quill is a popular open-source rich text editor built for the modern web. It provides a powerful API for creating and manipulating rich text content, making it widely used in various applications. The package is designed to be extensible and customizable, allowing developers to tailor the editor to their specific needs. However, a recent vulnerability has been identified in the HTML export feature, which can lead to security risks if not addressed.
Vulnerability Detail
The vulnerability arises from a lack of data validation in the HTML export feature of Quill version 2.0.3. This oversight allows attackers to inject malicious scripts into the exported HTML, leading to Cross-Site Scripting (XSS) attacks. Such attacks can compromise user data, hijack sessions, or redirect users to malicious sites. The vulnerability is classified under CWE-74, indicating improper neutralization of special elements in output used by a downstream component.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can sanitize the HTML output before rendering it in your application. Use a library like DOMPurify to clean the exported HTML and remove any potentially harmful scripts. Here is an example of how to use DOMPurify:
const cleanHTML = DOMPurify.sanitize(exportedHTML);
// Use cleanHTML in your application instead of the raw exportedHTML.
Conclusion
The identified vulnerability in Quill's HTML export feature poses a risk of XSS attacks. It is crucial for developers using this package to update to the latest version to mitigate potential security threats. Implementing sanitization measures can also help protect applications until the update is applied.
See every vulnerability recorded for quill →
FAQ
The CVSS score of this vulnerability is 2.0, indicating a low severity level.
The vulnerability affects Quill version 2.0.3.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring any signup.
If exploited, this vulnerability can lead to XSS attacks, compromising user data and potentially allowing attackers to hijack user sessions.
Yes, you can sanitize the HTML output using libraries like DOMPurify to remove any harmful scripts before rendering it in your application.
Related vulnerabilities
Recent vulnerabilities recorded for quill.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
