CVE-2025-15056: Quill is vulnerable to XSS via HTML export feature

January 13, 2026 (updated January 16, 2026)

A lack of data validation vulnerability in the HTML export feature in Quill in allows Cross-Site Scripting (XSS).

This issue affects Quill: 2.0.3.

References

fluidattacks.com/advisories/diomedes
github.com/advisories/GHSA-v3m3-f69x-jf25
github.com/slab/quill
nvd.nist.gov/vuln/detail/CVE-2025-15056

Code Behaviors & Features

Detect and mitigate CVE-2025-15056 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →