CVE-2025-15056
Medium · 6.1CVSS
6.1
EPSS
0.3%
Published
Jan 13, 2026
CISA due date
—
The record
A lack of data validation vulnerability in the HTML export feature in Quill in allows Cross-Site Scripting (XSS). This issue affects Quill: 2.0.3.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | quill | 2.0.3 | No fix |
Related vulnerabilities
- GHSA-v3m3-f69x-jf25 Quill is vulnerable to XSS via HTML export feature Same vulnerability
- CVE-2021-3163 A vulnerability in the HTML editor of Slab Quill 4.8.0 allows an attacker to execute… Also affects quill
- CVE-2026-96379 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79
- CVE-2026-96382 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79
- CVE-2026-96368 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79
- CVE-2026-96361 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79
- CVE-2026-96362 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79
- CVE-2026-96360 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79