medium4.9
CVE-2025-43954
QMarkdown Cross-Site Scripting (XSS) vulnerability
Impact
QMarkdown (aka quasar-ui-qmarkdown) before 2.0.5 allows XSS via headers even when when no-html is set.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | @quasar/quasar-ui-qmarkdown | < 2.0.5 | 2.0.5 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Quasar | Qmarkdown | before 2.0.5 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/quasarframework/quasar-ui-qmarkdown/commit/b61dff84851c45369cf931db5bd93db177c657f6
- https://github.com/quasarframework/quasar-ui-qmarkdown/compare/v2.0.4...v2.0.5
- https://github.com/advisories/GHSA-wm65-ph3w-587c
- https://nvd.nist.gov/vuln/detail/CVE-2025-43954