Quill is vulnerable to XSS via HTML export feature

中危 6.1CVE-2025-15056 · GHSA-v3m3-f69x-jf25 · Published 13/01/2026 · updated 17/06/2026

要点

Package	Affected versions	Patched versions
quill slab	`= 2.0.3`	No fix yet
quill npm	`= 2.0.3`	No fix yet

A lack of data validation vulnerability in the HTML export feature in Quill in allows Cross-Site Scripting (XSS).

This issue affects Quill: 2.0.3.

NVD description

A lack of data validation vulnerability in the HTML export feature in Quill in allows Cross-Site Scripting (XSS). This issue affects Quill: 2.0.3.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.