CVE-2021-3163: Cross-site Scripting

April 12, 2021 (updated November 7, 2023)

A vulnerability in the HTML editor of Slab Quill allows an attacker to execute arbitrary JavaScript by storing an XSS payload (a crafted onloadstart attribute of an IMG element) in a text field.

References

github.com/quilljs/quill/issues/3273
nvd.nist.gov/vuln/detail/CVE-2021-3163

Code Behaviors & Features

Detect and mitigate CVE-2021-3163 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →