{"id":"GHSA-588m-9qg5-35pq","aliases":["CLSA-2026-1786358308"],"status":"published","title":"Reverse Tabnabbing in quill","description":"Versions of `quill` prior to 1.3.7 are vulnerable to [Reverse Tabnabbing](https://www.owasp.org/index.php/Reverse_Tabnabbing). The package uses `target='_blank'` in anchor tags, allowing attackers to access `window.opener` for the original page when opening links. This is commonly used for phishing attacks.\n\n\n## Recommendation\n\nNo fix is currently available. Consider using an alternative package until a fix is made available.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1022"],"published":"2020-09-03T17:19:09Z","modified":"2026-10-15T09:45:59Z","fixes":[{"ecosystem":"npm","package":"quill","fixed_in":["1.3.7"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"quill","fixed_in":["1.3.7-tuxcare.6"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"quill","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.7"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"quill","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.3.7-tuxcare.0"},{"fixed":"1.3.7-tuxcare.6"}]}],"versions":["1.3.7","1.3.7-tuxcare.1","1.3.7-tuxcare.2","1.3.7-tuxcare.3","1.3.7-tuxcare.4","1.3.7-tuxcare.5"]},{"source":"osv","ecosystem":"npm","package":"quill","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.3.7"}]}]}],"references":[{"url":"https://github.com/quilljs/quill/issues/2438","tags":["web"]},{"url":"https://github.com/quilljs/quill/pull/2674","tags":["web"]},{"url":"https://www.npmjs.com/advisories/1039","tags":["web"]},{"url":"https://github.com/advisories/GHSA-588m-9qg5-35pq"},{"url":"https://github.com/quilljs/quill","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-588m-9qg5-35pq","title":"Reverse Tabnabbing in quill","description":"Versions of `quill` prior to 1.3.7 are vulnerable to [Reverse Tabnabbing](https://www.owasp.org/index.php/Reverse_Tabnabbing). The package uses `target='_blank'` in anchor tags, allowing attackers to access `window.opener` for the original page when opening links. This is commonly used for phishing attacks.\n\n\n## Recommendation\n\nNo fix is currently available. Consider using an alternative package until a fix is made available.","status":"published","published":"2020-09-03T17:19:09Z","modified":"2023-01-09T05:03:49Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-1022"],"updated_at":"2026-11-02T14:36:06.884904Z"}],"osv":[{"id":"GHSA-588m-9qg5-35pq","title":"Reverse Tabnabbing in quill","description":"Versions of `quill` prior to 1.3.7 are vulnerable to [Reverse Tabnabbing](https://www.owasp.org/index.php/Reverse_Tabnabbing). The package uses `target='_blank'` in anchor tags, allowing attackers to access `window.opener` for the original page when opening links. This is commonly used for phishing attacks.\n\n\n## Recommendation\n\nNo fix is currently available. Consider using an alternative package until a fix is made available.","status":"published","published":"2020-09-03T17:19:09Z","modified":"2021-09-28T22:06:18Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-1022"],"updated_at":"2026-11-02T15:46:38.213481Z"},{"id":"CLSA-2026-1786358308","title":"TuxCare security update for quill (1 CVE)","description":"TuxCare rebuilt quill to address 1 CVE. Fixed in 1.3.7-tuxcare.6.","status":"published","published":"2026-08-10T10:38:28Z","modified":"2026-10-15T09:45:59.340290469Z","updated_at":"2026-11-02T15:43:46.850893Z"}]}}