Cross-Site Scripting

Overview

A vulnerability in the HTML editor of Slab Quill allows an attacker to execute arbitrary JavaScript by storing an XSS payload (a crafted onloadstart attribute of an IMG element) in a text field. No patch exists and no further releases are planned.

Recommendation

Avoid using quill as there is no current safe version of this module

References

• CVE
• GitHub Advisory