Quill vulnerabilitiesQuill: known vulnerabilities and safe versions
npm: quill
Quill has 3 known vulnerability records: 2 in the npm advisory data (GitHub Advisory Database via OSV, the same source npm audit uses) and 1 only in Retire.js (CDN builds and advisories without a CVE).
By branch: 2.x is safe from 2.0.4; 1.x is safe from 1.3.8.
Vulnerabilities and safe version by branch
Safe version: on that branch, this release and every later one (up to the branch's latest release, where known) fall outside every known record's range. Candidates are only the records' own fixed versions and the branch's latest release; "No fix" means moving off the branch.
Support dates appear only for libraries that endoflife.date tracks.
Records
Newest first. Ranges are the record's own data; several ranges mean separate fixes per branch.
CVE-2025-150562026-01-13
Quill 2.0.3 - Lack of data validation in HTML export allowing XSS
Affected versions: = 2.0.3 · >= 2.0.3, < 2.0.4
medium 5.1
Fixed in: 2.0.4
CVE-2021-31632021-04-12
A vulnerability in the HTML editor of Slab Quill 4.8.0 allows an attacker to execute arbitrary JavaScript by storing an XSS payload (a craft
Affected versions: <= 1.3.7 · < 1.3.8
medium 6.1
Fixed in: 1.3.8
EPSS 1.3%
Versions of Quill prior to 1.3.7 are vulnerable to Reverse Tabnabbing. The package uses target='_blank' in anchor tags without rel='noopener', allowing pages opened via Quill links to access and manipulate the window.opener of the original
Affected versions: < 1.3.7
medium
Fixed in: 1.3.7
Sources and method
Ranges: GitHub Advisory Database (OSV npm export, daily) and Retire.js (Apache-2.0). Exploitation: CISA KEV, FIRST EPSS and exploit maturity from the Noroxi CVE database. Support dates: endoflife.date.
This page and the JavaScript library scan use the same matching rule: a row without bounds is not evidence, and versions are compared in one place. A record without a version range never counts as "affected" in the version check.
Data as of October 20, 2026.