Executive brief
Quill is a widely-used JavaScript rich text editor embedded in web applications and content management systems. This vulnerability allows attackers to inject malicious code into stored content by crafting a specially-formed image tag, which then executes in the browsers of users viewing that content. Organizations using unpatched versions could face account compromise, data theft, or malware distribution through stored XSS attacks. The vulnerability is particularly concerning because it bypasses the editor's client-side validation and requires server-side sanitization to prevent exploitation.
Technical details
This is a stored cross-site scripting (CWE-79) vulnerability in the Quill rich text editor. The root cause is insufficient input sanitization of HTML content, specifically the handling of IMG element attributes. An attacker can craft a payload containing an onloadstart event handler (e.g., `<div><image src=x.png onloadstart=alert(1337)></div>`) and inject it into an editor field through an intercepted API request, bypassing client-side validation. The payload is stored server-side and subsequently rendered to other users, executing the attacker's arbitrary JavaScript in their browser context. This attack requires network access to the application endpoint and the ability to submit data through the editor (typically no special authentication required in a comment or shared content scenario). No official patch exists; the project maintainers have not issued a security release as of the advisory date. Mitigation requires server-side HTML sanitization in addition to the existing client-side validation.
Affected products
- Quill quill through 1.3.7
Timeline
- 2021-04-12: disclosed
- 2021-05-10: advisory