Cross-site Scripting in quill in Quill 1.3.7 (CVE-2021-3163)

[nbouvrette]

As detailed here GHSA-4943-9vgg-gr5r there is security vulnerability being tracked and it is also being reported when installing React-quill with npm:

quill  <=1.3.7
Severity: moderate
Cross-site Scripting in quill - https://github.com/advisories/GHSA-4943-9vgg-gr5r
fix available via `npm audit fix --force`
Will install react-quill@0.0.2, which is a breaking change
node_modules/quill
  react-quill  >=0.0.3
  Depends on vulnerable versions of quill
  node_modules/react-quill

It looks like this is being tracked here: slab/quill#3364 (+2 years old issue!?)

I'm not too sure what are the references about Quill 2 because the last Quill release dates from 2019... not too sure what is going on?

[alexkrolick]

See slab/quill#3768 (comment), we will update when they release 2.0 stable

in the meantime, could we generate a 2.0.0-dev.1 release of react-quill that uses https://www.npmjs.com/package/quill/v/2.0.0-dev.3 ?

[alexkrolick]

#711 if someone wants to get this PR up to date with the suggestions in the discussion

[freddsomm]

Hello. The issue is still here. Do you have an update on this?

[jeannnemelanie]

+1

[adgoncal]

@alexkrolick Quill 2 has been released. https://slab.com/blog/announcing-quill-2-0/