Summary
CVE-2025-15056 / GHSA-v3m3-f69x-jf25 reports an XSS vulnerability in Quill's HTML export feature affecting v2.0.3. As of today (2026-04-17), the GitHub Advisory lists `Patched versions: None` and the latest published tag on npm is still `2.0.3`.
Our security scanner (Semgrep Supply Chain) flags this as a blocking finding across our project, and we rely on Quill's rich-text editor in production.
Questions for maintainers
- Is a patched release planned? Any ETA for `2.0.4` or similar that addresses CVE-2025-15056?
- Recommended mitigation while awaiting an official fix — beyond disabling HTML export entirely, what does the team suggest? (e.g., DOMPurify sanitization before `root.innerHTML` access and around `dangerouslyPasteHTML`, a CSP tweak, etc.)
- Dev-channel / experimental build — the `dev` dist-tag currently resolves to `2.0.0-dev.4` which predates the vulnerable code path, and there's no `next` tag. Is there an in-progress branch we could track or test?
Environment
- Quill: `2.0.3` (latest, from `npm view quill version`)
- Usage pattern (representative):
```js
import Quill from 'quill';
const quill = new Quill(el, { theme: 'snow' });
quill.on('text-change', () => {
const html = quill.root.innerHTML; // flagged sink
});
quill.clipboard.dangerouslyPasteHTML(userContent); // flagged sink
```
Why this matters
Many downstream users (we're one of potentially thousands, given Quill's popularity) rely on a patched release landing in the `2.x` line so we can bump without forking or rewriting the editor integration. An officially-blessed mitigation pattern in the README or SECURITY.md would also help teams that can't wait.
Happy to test any preview builds or contribute a PR if there's consensus on the fix approach. Thanks for the project!
Filed while auditing our own supply chain as part of a Semgrep-driven security pass.
Summary
CVE-2025-15056 / GHSA-v3m3-f69x-jf25 reports an XSS vulnerability in Quill's HTML export feature affecting v2.0.3. As of today (2026-04-17), the GitHub Advisory lists `Patched versions: None` and the latest published tag on npm is still `2.0.3`.
Our security scanner (Semgrep Supply Chain) flags this as a blocking finding across our project, and we rely on Quill's rich-text editor in production.
Questions for maintainers
Environment
```js
import Quill from 'quill';
const quill = new Quill(el, { theme: 'snow' });
quill.on('text-change', () => {
const html = quill.root.innerHTML; // flagged sink
});
quill.clipboard.dangerouslyPasteHTML(userContent); // flagged sink
```
Why this matters
Many downstream users (we're one of potentially thousands, given Quill's popularity) rely on a patched release landing in the `2.x` line so we can bump without forking or rewriting the editor integration. An officially-blessed mitigation pattern in the README or SECURITY.md would also help teams that can't wait.
Happy to test any preview builds or contribute a PR if there's consensus on the fix approach. Thanks for the project!
Filed while auditing our own supply chain as part of a Semgrep-driven security pass.