CVE-2025-43954: QMarkdown Cross-Site Scripting (XSS) vulnerability

April 20, 2025 (updated April 21, 2025)

QMarkdown (aka quasar-ui-qmarkdown) before 2.0.5 allows XSS via headers even when when no-html is set.

References

github.com/advisories/GHSA-wm65-ph3w-587c
github.com/quasarframework/quasar-ui-qmarkdown
github.com/quasarframework/quasar-ui-qmarkdown/commit/b61dff84851c45369cf931db5bd93db177c657f6
github.com/quasarframework/quasar-ui-qmarkdown/compare/v2.0.4...v2.0.5
nvd.nist.gov/vuln/detail/CVE-2025-43954

Code Behaviors & Features

Detect and mitigate CVE-2025-43954 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →