CVE-2025-15056
Quill 2.0.3
- Class
- XSS
- Severity
- Medium · CVSS 4.0 score 5.1
- Disclosed
- Credit
- Cristian Vargas, Fluid Attacks Offensive Team
- Code name
- diomedes
- Affected
- Quill 2.0.3
The defect
XSS in HTML export (formula/video formats)
Class overview · XSS
Attacker-controlled markup or a script context breaks out in the browser of whoever views the page. Consequences run from actions taken with the victim's privileges to full account takeover when the script runs in their session.