Is CVE-2025-43954 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-43954 being exploited in the wild.

How severe is CVE-2025-43954?

Low severity, with a CVSS score of 3.1, published 20 April 2025.

Which products and versions are affected?

@quasar/quasar-ui-qmarkdown (npm) SEMVER:introduced=0,fixed=2.0.5; Quasar-Ui-Qmarkdown before 2.0.5.

Is there a fix for CVE-2025-43954?

Yes. @quasar/quasar-ui-qmarkdown (npm): upgrade to 2.0.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-43954 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2025-43954?

Check whether you run @quasar/quasar-ui-qmarkdown (npm) or Quasar-Ui-Qmarkdown at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-43954: QMarkdown Cross-Site Scripting (XSS) in headers with no-html

CVE-2025-43954 · Severity: low · CVSS 3.1 · Published 2025-04-20

QMarkdown is a markdown rendering library used in web applications to display formatted text. A Cross-Site Scripting (XSS) vulnerability allows attackers to inject malicious scripts into markdown headers even when the no-html security setting is enabled, potentially compromising user sessions or stealing data. This affects applications that render untrusted user-supplied markdown content.

Vendors: npm, Quasar.

Quick answers

Is CVE-2025-43954 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-43954 being exploited in the wild.
How severe is CVE-2025-43954?: Low severity, with a CVSS score of 3.1, published 20 April 2025.
Which products and versions are affected?: @quasar/quasar-ui-qmarkdown (npm) SEMVER:introduced=0,fixed=2.0.5; Quasar-Ui-Qmarkdown before 2.0.5.
Is there a fix for CVE-2025-43954?: Yes. @quasar/quasar-ui-qmarkdown (npm): upgrade to 2.0.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-43954 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2025-43954?: Check whether you run @quasar/quasar-ui-qmarkdown (npm) or Quasar-Ui-Qmarkdown at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@quasar/quasar-ui-qmarkdown (npm): upgrade to 2.0.5 or later
```
npm install @quasar/quasar-ui-qmarkdown@2.0.5
```

Technical details

QMarkdown (quasar-ui-qmarkdown) before version 2.0.5 contains a Cross-Site Scripting (CWE-79) vulnerability in header processing that bypasses the no-html protection flag. The vulnerability exists because the component fails to properly sanitize HTML/script content in markdown headers even when no-html mode is explicitly set. Attack requires the ability to supply markdown input (no authentication required for public-facing applications), and is network-accessible. An attacker can inject arbitrary JavaScript that executes in the context of the victim's browser. The vulnerability was patched in version 2.0.5 via commit b61dff8, which added proper XSS prevention while maintaining markdown rendering in headers.

Affected products

Quasar quasar-ui-qmarkdown before 2.0.5

Identifiers

CVE-2025-43954
GHSA-wm65-ph3w-587c

Timeline

2025-04-20: disclosed: Vulnerability published as GHSA-wm65-ph3w-587c and CVE-2025-43954
2025-02-27: patched: Fixed in version 2.0.5 via commit b61dff84851c45369cf931db5bd93db177c657f6

References

https://github.com/quasarframework/quasar-ui-qmarkdown/commit/b61dff84851c45369cf931db5bd93db177c657f6

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.