CVE-2023-26149

🗓️ 28 Sep 2023 05:00:02Reported by snykType

Versions of quill-mention before 4.0.0 are vulnerable to Cross-site Scripting (XSS) due to improper user-input sanitization in the renderList function

Reporter	Title	Published	Views	Family All 14
Circl	CVE-2023-26149	28 Sep 202312:49	–	circl
CNNVD	Quill Cross-Site Scripting Vulnerability	28 Sep 202300:00	–	cnnvd
CVE	CVE-2023-26149	28 Sep 202305:00	–	cve
EUVD	EUVD-2023-2536	3 Oct 202520:07	–	euvd
Github Security Blog	quill-mention Cross-site Scripting vulnerability	28 Sep 202306:30	–	github
NVD	CVE-2023-26149	28 Sep 202305:15	–	nvd
OSV	GHSA-JGW5-RP4P-QHP6 quill-mention Cross-site Scripting vulnerability	28 Sep 202306:30	–	osv
Prion	Cross site scripting	28 Sep 202305:15	–	prion
Positive Technologies	PT-2023-20527 · Unknown · Quill-Mention	27 Sep 202300:00	–	ptsecurity
RedhatCVE	CVE-2023-26149	23 May 202504:39	–	redhatcve

[
  {
    "product": "quill-mention",
    "versions": [
      {
        "version": "0",
        "lessThan": "4.0.0",
        "status": "affected",
        "versionType": "semver"
      }
    ],
    "vendor": "n/a"
  }
]

Source	Link
github	www.github.com/quill-mention/quill-mention/pull/341
github	www.github.com/quill-mention/quill-mention/issues/255
codepen	www.codepen.io/ALiangLiang/pen/mdQMJXK
github	www.github.com/quill-mention/quill-mention/commit/e85262ddced0a7f0b6fc8350d236a68bd1e28385
github	www.github.com/quill-mention/quill-mention/blob/0aa9847719257496b14ac5401872c4e2ffcbc3d1/src/quill.mention.js%23L391
security	www.security.snyk.io/vuln/SNYK-JS-QUILLMENTION-5921549

28 Sep 2023 05:00Current

6.4Medium risk

Vulners AI Score6.4

CVSS 3.16.1

EPSS0.0057