Executive brief
quill-mention is a JavaScript library that adds @-mention functionality to the Quill rich text editor. The library contains a cross-site scripting (XSS) vulnerability in how it renders mention lists: user-supplied mention data is inserted into the page using innerHTML without sanitization, allowing attackers to inject malicious scripts when users trigger the mention feature with @. This could enable attackers to steal user credentials, deface content, or redirect users to malicious sites.
Technical details
The vulnerability is a reflected cross-site scripting (XSS) flaw in the renderList function (CWE-79). The vulnerable component uses innerHTML to render mention list items without escaping or sanitizing user-controlled input. The attack requires that the mentions list be populated from untrusted (user-sourced) data and that a user trigger the @-mention feature in the Quill editor. An attacker can inject HTML and JavaScript payloads that execute in the context of the user's browser. The vulnerability was fixed in version 4.0.0 by changing the renderItem function to use DOM methods (textContent) instead of innerHTML, preventing script injection.
Affected products
- quill-mention quill-mention before 4.0.0
Timeline
- 2022-06-24: disclosed: Issue #255 reported on GitHub
- 2023-09-28: patched: Fixed in version 4.0.0
- 2023-09-28: advisory: CVE-2023-26149 and GHSA-jgw5-rp4p-qhp6 published