Cross-Site Scripting Vulnerability in Quill by Slab
CVE-2025-15056

5.1MEDIUM

Key Information:

Vendor

Slab

Status
Quill
Vendor
CVE Published:
13 January 2026

What is CVE-2025-15056?

A vulnerability in the HTML export feature of Quill allows attackers to exploit insufficient data validation, leading to the potential execution of malicious scripts in user browsers. This Cross-Site Scripting (XSS) issue could compromise the security of web applications that utilize this functionality, affecting user data security and integrity. Users are advised to review the affected versions and apply necessary updates to mitigate risks.

Affected Version(s)

Quill Linux 2.0.3

References

https://fluidattacks.com/advisories/diomedes
third-party-advisory
https://github.com/slab/quill
product

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Cristian Vargas
.