quill-mention Cross-site Scripting vulnerability
Moderate severity
GitHub Reviewed
Published
Sep 28, 2023
to the GitHub Advisory Database
•
Updated Nov 10, 2023
Description
Published by the National Vulnerability Database
Sep 28, 2023
Published to the GitHub Advisory Database
Sep 28, 2023
Reviewed
Sep 28, 2023
Last updated
Nov 10, 2023
Versions of the package quill-mention before 4.0.0 are vulnerable to Cross-site Scripting (XSS) due to improper user-input sanitization, via the renderList function.
Note:
If the mentions list is sourced from unsafe (user-sourced) data, this might allow an injection attack when a Quill user hits @.
References