CVE-2025-15056 - Vulnerability Details - OpenCVE

A lack of data validation vulnerability in the HTML export feature in Quill in allows Cross-Site Scripting (XSS).

This issue affects Quill: 2.0.3.

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction Active

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact Low

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Slab Subscribe	Quill Subscribe

No data.

No data.

No data.

Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://fluidattacks.com/advisories/diomedes
https://github.com/slab/quill

History

Tue, 13 Jan 2026 22:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Tue, 13 Jan 2026 21:00:00 +0000

Type	Values Removed	Values Added
Description		A lack of data validation vulnerability in the HTML export feature in Quill in allows Cross-Site Scripting (XSS). This issue affects Quill: 2.0.3.
Title		Quill 2.0.3 - Lack of data validation in HTML export allowing XSS
First Time appeared		Slab Slab quill
Weaknesses		CWE-74
CPEs		cpe:2.3:a:slab:quill:2.0.3::linux::::: cpe:2.3:a:slab:quill:2.0.3::macos::::: cpe:2.3:a:slab:quill:2.0.3::windows:::::
Vendors & Products		Slab Slab quill
References		https://fluidattacks.com/advisories/diomedes https://github.com/slab/quill
Metrics		cvssV4_0 `{'score': 5.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N'}`

Projects

Sign in to view the affected projects.

MITRE

Status: PUBLISHED

Assigner: Fluid Attacks

Published: 2026-01-13T20:39:29.627Z

Updated: 2026-01-13T21:27:56.936Z

Reserved: 2025-12-23T18:21:36.039Z

Link: CVE-2025-15056

Vulnrichment

Updated: 2026-01-13T21:27:50.983Z

NVD

Status : Received

Published: 2026-01-13T21:15:49.720

Modified: 2026-01-13T21:15:49.720

Link: CVE-2025-15056

Redhat

No data.

OpenCVE Enrichment

No data.

Weaknesses

CWE-74

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-15056", "assignerOrgId": "84fe0718-d6bb-4716-a7e8-81a6d1daa869", "state": "PUBLISHED", "assignerShortName": "Fluid Attacks", "dateReserved": "2025-12-23T18:21:36.039Z", "datePublished": "2026-01-13T20:39:29.627Z", "dateUpdated": "2026-01-13T21:27:56.936Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://registry.npmjs.org", "defaultStatus": "unaffected", "packageName": "quill", "platforms": ["Linux", "MacOS", "Windows"], "product": "Quill", "vendor": "Slab", "versions": [{"status": "affected", "version": "2.0.3"}]}], "cpeApplicability": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:slab:quill:2.0.3:*:linux:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:slab:quill:2.0.3:*:macos:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:slab:quill:2.0.3:*:windows:*:*:*:*:*", "vulnerable": true}], "negate": false, "operator": "OR"}], "operator": "OR"}], "credits": [{"lang": "en", "type": "finder", "value": "Cristian Vargas"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>A lack of data validation vulnerability in the HTML export feature in Quill in allows Cross-Site Scripting (XSS).</p><p>This issue affects Quill: 2.0.3.</p>"}], "value": "A lack of data validation vulnerability in the HTML export feature in Quill in allows Cross-Site Scripting (XSS).\n\nThis issue affects Quill: 2.0.3."}], "impacts": [{"capecId": "CAPEC-63", "descriptions": [{"lang": "en", "value": "CAPEC-63 Cross-Site Scripting (XSS)"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 5.1, "baseSeverity": "MEDIUM", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "LOW", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-74", "description": "CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "84fe0718-d6bb-4716-a7e8-81a6d1daa869", "shortName": "Fluid Attacks", "dateUpdated": "2026-01-13T20:39:36.625Z"}, "references": [{"tags": ["third-party-advisory"], "url": "https://fluidattacks.com/advisories/diomedes"}, {"tags": ["product"], "url": "https://github.com/slab/quill"}], "source": {"discovery": "UNKNOWN"}, "title": "Quill 2.0.3 - Lack of data validation in HTML export allowing XSS", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-13T21:27:41.232640Z", "id": "CVE-2025-15056", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-13T21:27:56.936Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-15056", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-13T21:27:41.232640Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-13T21:27:50.983Z"}}], "cna": {"title": "Quill 2.0.3 - Lack of data validation in HTML export allowing XSS", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Cristian Vargas"}], "impacts": [{"capecId": "CAPEC-63", "descriptions": [{"lang": "en", "value": "CAPEC-63 Cross-Site Scripting (XSS)"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Slab", "product": "Quill", "versions": [{"status": "affected", "version": "2.0.3"}], "platforms": ["Linux", "MacOS", "Windows"], "packageName": "quill", "collectionURL": "https://registry.npmjs.org", "defaultStatus": "unaffected"}], "references": [{"url": "https://fluidattacks.com/advisories/diomedes", "tags": ["third-party-advisory"]}, {"url": "https://github.com/slab/quill", "tags": ["product"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "A lack of data validation vulnerability in the HTML export feature in Quill in allows Cross-Site Scripting (XSS).\n\nThis issue affects Quill: 2.0.3.", "supportingMedia": [{"type": "text/html", "value": "<p>A lack of data validation vulnerability in the HTML export feature in Quill in allows Cross-Site Scripting (XSS).</p><p>This issue affects Quill: 2.0.3.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-74", "description": "CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:slab:quill:2.0.3:*:linux:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:slab:quill:2.0.3:*:macos:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:slab:quill:2.0.3:*:windows:*:*:*:*:*", "vulnerable": true}], "operator": "OR"}], "operator": "OR"}], "providerMetadata": {"orgId": "84fe0718-d6bb-4716-a7e8-81a6d1daa869", "shortName": "Fluid Attacks", "dateUpdated": "2026-01-13T20:39:36.625Z"}}}, "cveMetadata": {"cveId": "CVE-2025-15056", "state": "PUBLISHED", "dateUpdated": "2026-01-13T21:27:56.936Z", "dateReserved": "2025-12-23T18:21:36.039Z", "assignerOrgId": "84fe0718-d6bb-4716-a7e8-81a6d1daa869", "datePublished": "2026-01-13T20:39:29.627Z", "assignerShortName": "Fluid Attacks"}, "dataVersion": "5.2"}