Is CVE-2021-3163 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2021-3163 being exploited in the wild.

How severe is CVE-2021-3163?

Low severity, with a CVSS score of 3.1, published 10 May 2021.

Which products and versions are affected?

quill (npm) SEMVER:introduced=0,last_affected=1.3.7.

Is there a fix for CVE-2021-3163?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2021-3163 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2021-3163?

Check whether you run quill (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2021-3163: Quill stored cross-site scripting via crafted image tag

CVE-2021-3163 · Severity: low · CVSS 3.1 · Published 2021-05-10

Quill is a widely-used JavaScript rich text editor embedded in web applications and content management systems. This vulnerability allows attackers to inject malicious code into stored content by crafting a specially-formed image tag, which then executes in the browsers of users viewing that content. Organizations using unpatched versions could face account compromise, data theft, or malware distribution through stored XSS attacks. The vulnerability is particularly concerning because it bypasses the editor's client-side validation and requires server-side sanitization to prevent exploitation.

Technologies: quill (npm). Vendors: npm.

Quick answers

Is CVE-2021-3163 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2021-3163 being exploited in the wild.
How severe is CVE-2021-3163?: Low severity, with a CVSS score of 3.1, published 10 May 2021.
Which products and versions are affected?: quill (npm) SEMVER:introduced=0,last_affected=1.3.7.
Is there a fix for CVE-2021-3163?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2021-3163 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2021-3163?: Check whether you run quill (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This is a stored cross-site scripting (CWE-79) vulnerability in the Quill rich text editor. The root cause is insufficient input sanitization of HTML content, specifically the handling of IMG element attributes. An attacker can craft a payload containing an onloadstart event handler (e.g., `<div><image src=x.png onloadstart=alert(1337)></div>`) and inject it into an editor field through an intercepted API request, bypassing client-side validation. The payload is stored server-side and subsequently rendered to other users, executing the attacker's arbitrary JavaScript in their browser context. This attack requires network access to the application endpoint and the ability to submit data through the editor (typically no special authentication required in a comment or shared content scenario). No official patch exists; the project maintainers have not issued a security release as of the advisory date. Mitigation requires server-side HTML sanitization in addition to the existing client-side validation.

Affected products

Quill quill through 1.3.7

Identifiers

CVE-2021-3163
GHSA-4943-9vgg-gr5r

Timeline

2021-04-12: disclosed
2021-05-10: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.