Cross Site Scripting (XSS)

2023-10-0911:06:09

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

quill-mention

xss

vulnerability

escaping

sanitization

list items

innerhtml

attacker

malicious script

web page

potential attack

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

25.8%

JSON

quill-mention is vulnerable to Cross Site Scripting. The vulnerability is due to mention.js and quill.mention.js as there is no escaping or sanitization for the list items which are rendered using innerHTML. This allows an attacker to insert a malicious script in innerHTML. When the script is rendered on the web page, it will get executed and leads to a potential Cross-site Scripting (XSS) attack.