Quill’s HTML export feature fails to validate injectable content, which allows an attacker to insert malicious script tags into an export file. When a user opens the resulting HTML document in a browser, the embedded JavaScript runs in the victim’s context, giving the attacker the ability to steal session information, deface content, or perform other malicious actions in the user’s browser. The weakness is identified by CWE‑79 (Improper Neutralization of Input in a Web Page).

The vulnerability affects the Quill library version 2.0.3 released by Slab. It is present in all supported environments for that version, including Node.js deployments, and installations on Linux, macOS, and Windows.

The CVSS v3 score of 5.1 indicates a moderate severity level. The EPSS score being less than 1% suggests a low probability of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to supply a crafted export file and persuade a user to open it in a browser that renders the HTML, making it a local or user‑interaction‑based attack vector.