CVE-2025-15056: Quill 2.0.3 - Lack of data validation in HTML export allowing XSS
Published Jan 13, 2026
·Updated
A lack of data validation vulnerability in the HTML export feature in Quill in allows Cross-Site Scripting (XSS).
This issue affects Quill: 2.0.3.
Affected Software
3 affected components
npm/quill
npm/quill=2.0.3
Slab Quill Node.js=2.0.3
Event History
Jan 13, 2026
CVE Published
via MITRE·08:39 PM
Data Sourced
via MITRE·08:39 PM
DescriptionWeakness
Data Sourced
via NVD·09:15 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·09:15 PM
Affected Software
Advisory Published
via GitHub·09:31 PM
Data Sourced
via GitHub·09:31 PM
DescriptionWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2025-15056?
CVE-2025-15056 has a moderate severity rating due to its potential for Cross-Site Scripting (XSS) attacks.
2
How do I fix CVE-2025-15056?
To fix CVE-2025-15056, update Quill to a version that includes data validation improvements in the HTML export feature.
3
What software is affected by CVE-2025-15056?
CVE-2025-15056 specifically affects Quill version 2.0.3.
4
What are the risks of not addressing CVE-2025-15056?
Not addressing CVE-2025-15056 can lead to the possibility of an attacker exploiting XSS vulnerabilities to inject malicious scripts.
5
How can I detect CVE-2025-15056 in my application?
You can detect CVE-2025-15056 by scanning your application for the specific version of Quill and reviewing the implementation of the HTML export feature.