Cross-site Scripting in quill in Quill 1.3.7 (CVE-2021-3163)

[nbouvrette]

As detailed here https://github.com/advisories/GHSA-4943-9vgg-gr5r there is security vulnerability being tracked and it is also being reported when installing React-quill with npm:

quill  <=1.3.7
Severity: moderate
Cross-site Scripting in quill - https://github.com/advisories/GHSA-4943-9vgg-gr5r
fix available via `npm audit fix --force`
Will install [email protected], which is a breaking change
node_modules/quill
  react-quill  >=0.0.3
  Depends on vulnerable versions of quill
  node_modules/react-quill

It looks like this is being tracked here: https://github.com/quilljs/quill/issues/3364 (+2 years old issue!?)

I'm not too sure what are the references about Quill 2 because the last Quill release dates from 2019... not too sure what is going on?

[alexkrolick]

See https://github.com/quilljs/quill/issues/3768#issuecomment-1654873923, we will update when they release 2.0 stable

[matthew-cook-dxd]

in the meantime, could we generate a 2.0.0-dev.1 release of react-quill that uses https://www.npmjs.com/package/quill/v/2.0.0-dev.3 ?

[alexkrolick]

https://github.com/zenoamaro/react-quill/pull/711 if someone wants to get this PR up to date with the suggestions in the discussion

[freddsomm]

Hello. The issue is still here. Do you have an update on this?

[jeannnemelanie]

+1

[adgoncal]

@alexkrolick Quill 2 has been released. https://slab.com/blog/announcing-quill-2-0/