Fix: Security - XSS vulnerability in formula and video HTML export#4771
Closed
Fix: Security - XSS vulnerability in formula and video HTML export#4771
Conversation
added 2 commits
January 20, 2026 12:02
- Escape user-controlled values in formula html() output - Escape video URLs in html() output - Add comprehensive XSS prevention tests - Update CHANGELOG for v2.0.4 Fixes critical XSS vulnerability where malicious formulas or video URLs could execute JavaScript when exported HTML is rendered. All special HTML characters (<, >, &, ", ') are now properly escaped in embed output. This addresses a vulnerability in Quill 2.0.0-2.0.3 where the html() methods in Formula and Video blots directly interpolated user-controlled values into HTML strings without escaping. Attack example: quill.insertEmbed(0, 'formula', '</span><img src=x onerror=alert(1)>'); quill.getSemanticHTML(); // Would output unescaped HTML Impact: Applications using getSemanticHTML() to export and render content were vulnerable to XSS attacks through malicious embed values. Fix: Added escaping using existing escapeText() utility from blots/text.ts BREAKING: None - this is a security fix with no functional changes. Output HTML format changes only for inputs containing special characters, which now correctly escape to valid HTML entities.
- Add KaTeX mock for formula tests to prevent initialization errors - Improve test assertions to check for actual exploit patterns - Fix formula test: check for '<img' tag presence instead of 'onerror=' - Fix video test: check for '" onclick="' pattern instead of 'onclick=' All 14 XSS prevention tests now pass (8 formula + 6 video). All 535 unit tests pass with no regressions.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Security Fix: XSS Vulnerability in HTML Export
Summary
Fixed CVE-2025-15056: A Cross-Site Scripting (XSS) vulnerability in the
getSemanticHTML()method caused by lack of data validation in the HTML export feature. This allowed arbitrary JavaScript execution through malicious formula and video embeds.Vulnerability Details
CVE: CVE-2025-15056
GHSA: GHSA-v3m3-f69x-jf25
Affected versions: ≤ 2.0.3
Patched versions: None (this PR provides the fix)
Severity: Low
CWE: CWE-79 (Improper Neutralization of Input During Web Page Generation)
npm audit output:
quill ≤2.0.3 Quill is vulnerable to XSS via HTML export feature fix available via npm audit fix
Attack Vector
The vulnerability existed in two blot types that failed to escape user-controlled content:
Formula blots (
src/formats/formula.ts):Video blots (
src/formats/video.ts):Example exploit:
Fix Implementation
Formula blots (src/formats/formula.ts): Now escape all HTML special characters in formula values before rendering
Video blots (src/formats/video.ts): Now escape video URLs in both href attributes and text content
Uses existing escapeText() utility to escape: &, <, >, ", '
Testing
Added 14 comprehensive security tests (8 for formula, 6 for video)
All 535 existing tests pass - no breaking changes
Verified prevention of:
HTML tag injection
Attribute injection
Quote breaking
Event handler injection
Backwards Compatibility
✅ Fully backwards compatible
No API changes
Delta format unchanged
Only affects HTML output (now properly escaped)
Changelog
Updated CHANGELOG.md for v2.0.4 security release
Note to maintainers: This should be treated as a security release. Consider:
Assigning a CVE
Publishing a security advisory
Backporting to previous major versions if applicable