Description
Description
The react-quill library used by the application has not been updated since 2022 and the
maintainer added the following deprecation notice last year:
https://github.com/zenoamaro/react-quill/commit/
615b4bf730e7a34c1dda1707447123c1d727f9d1
The react-quill library is built upon Quill v1, and it's using a known insecure pattern
vulnerable to XSS:
https://github.com/zenoamaro/react-quill/blob/master/src/index.tsx#L387
Calling editor.clipboard.convert(value) in Quill v1 with unsanitized user input is
known to be vulnerable to XSS: slab/quill#3364
Description
Description
The react-quill library used by the application has not been updated since 2022 and the
maintainer added the following deprecation notice last year:
https://github.com/zenoamaro/react-quill/commit/
615b4bf730e7a34c1dda1707447123c1d727f9d1
The react-quill library is built upon Quill v1, and it's using a known insecure pattern
vulnerable to XSS:
https://github.com/zenoamaro/react-quill/blob/master/src/index.tsx#L387
Calling editor.clipboard.convert(value) in Quill v1 with unsanitized user input is
known to be vulnerable to XSS: slab/quill#3364