CVE-2025-15056: Quill is vulnerable to XSS via HTML export feature

January 13, 2026 (updated April 10, 2026)

A lack of data validation vulnerability in the HTML export feature in Quill in allows Cross-Site Scripting (XSS).

This issue affects Quill: 2.0.3.

References

fluidattacks.com/advisories/diomedes
github.com/advisories/GHSA-v3m3-f69x-jf25
github.com/slab/quill
nvd.nist.gov/vuln/detail/CVE-2025-15056

Code Behaviors & Features

Detect and mitigate CVE-2025-15056 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →