168wangxiao-ui (>=0.3.6 <=0.3.70), 3achatlibrary (>=1.0.0 <=1.0.9) +4575 more potentially affected by CVE-2021-3163 via quill (>=0.19.14 <=1.3.7)

quill NPM version =0.19.14, =0.3.6, =1.0.0, =19.0.0, =1.0.1, =1.0.0, =1.0.10, =3.1.1-0, =1.0.7, =19.0.0, =0.0.1, =3.0.10 and more Source cves: CVE-2021-3163 Source advisory: OSV:GHSA-4943-9VGG-GR5R...

CVE-2021-3163

Slab Quill 4.8.0 contains a stored XSS in its HTML editor. An attacker can inject JavaScript by storing an XSS payload using a crafted onloadstart attribute on an IMG element, leading to arbitrary script execution. Multiple sources (NVD entry, CNVD, OSV/GHSA advisories) describe the issue; adviso...

CVE-2021-3163

A vulnerability in the HTML editor of Slab Quill 4.8.0 allows an attacker to execute arbitrary JavaScript by storing an XSS payload a crafted onloadstart attribute of an IMG element in a text field. Note: Researchers have claimed that this issue is not within the product itself, but is intended...