CVE-2021-3163: XSS
DISPUTED A vulnerability in the HTML editor of Slab Quill 4.8.0 allows an attacker to execute arbitrary JavaScript by storing an XSS payload (a crafted onloadstart attribute of an IMG element) in a text field. Note: Researchers have claimed that this issue is not within the product itself, but is intended behavior in a web browser.
Other sources
A vulnerability in the HTML editor of Slab Quill allows an attacker to execute arbitrary JavaScript by storing an XSS payload (a crafted onloadstart attribute of an IMG element) in a text field. No patch exists and no further releases are planned.
This CVE is disputed. Researchers have claimed that this issue is not within the product itself, but is intended behavior in a web browser. More information can be found here.
— GitHub
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2021-3163?
The severity of CVE-2021-3163 is currently disputed, as researchers have indicated that the issue may not be inherent to the product itself.
How do I fix CVE-2021-3163?
To mitigate CVE-2021-3163, ensure that you sanitize user inputs properly to prevent the injection of malicious JavaScript.
What software is affected by CVE-2021-3163?
CVE-2021-3163 affects Slab Quill version 4.8.0 and npm package quill up to version 1.3.7.
What type of vulnerability is CVE-2021-3163?
CVE-2021-3163 is a vulnerability that allows for cross-site scripting (XSS) attacks via arbitrary JavaScript execution.
Can CVE-2021-3163 be exploited remotely?
Yes, CVE-2021-3163 can be exploited remotely if the attacker can manipulate text fields to include malicious payloads.