Reverse Tabnabbing in quill

GHSA-588m-9qg5-35pq

Published Sep 3, 2020 · Modified Sep 28, 2021

AI SAST

Find this class of vulnerability in your own code

Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.

Explore AI SAST Explore dependency scanning →

Description

Versions of quill prior to 1.3.7 are vulnerable to Reverse Tabnabbing. The package uses target='_blank' in anchor tags, allowing attackers to access window.opener for the original page when opening links. This is commonly used for phishing attacks.

Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.

References

WEB https://github.com/quilljs/quill/issues/2438
WEB https://github.com/quilljs/quill/pull/2674
PACKAGE https://github.com/quilljs/quill
WEB https://www.npmjs.com/advisories/1039

Ready to move

Start Securing

Start for Free Get Demo

Free, no credit card | First findings in minutes