Reverse Tabnabbing Affecting quill package, versions <1.3.7
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JS-QUILL-460312
- published 27 Aug 2019
- disclosed 5 Jul 2019
- credit Jonathan Lloyd
How to fix?
Upgrade quill to version 1.3.7 or higher.
Overview
quill is a modern rich text editor built for compatibility and extensibility.
Affected versions of this package are vulnerable to Reverse Tabnabbing due to use of target='_blank' in anchor tags, allowing attackers to access window.opener for the original page when opening links. This is commonly used for phishing attacks.
References
CVSS Scores
version 3.1