CVE-2025-43954
📋 TL;DR
QMarkdown (quasar-ui-qmarkdown) versions before 2.0.5 contain a cross-site scripting (XSS) vulnerability in header processing that bypasses the no-html security setting. This allows attackers to inject malicious scripts into web pages rendered by the component. Applications using vulnerable versions of this Quasar Framework markdown component are affected.
💻 Affected Systems
- quasar-ui-qmarkdown
- QMarkdown
📦 What is this software?
Qmarkdown by Quasar
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal user session cookies, credentials, or sensitive data, perform actions on behalf of authenticated users, or redirect users to malicious sites.
Likely Case
Limited data theft from users who interact with maliciously crafted markdown content, potentially leading to account compromise in affected applications.
If Mitigated
With proper content sanitization and security headers, impact is limited to minor UI manipulation or data leakage from specific user interactions.
🎯 Exploit Status
Exploitation requires ability to inject malicious markdown headers into content processed by the component.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.0.5
Vendor Advisory: https://github.com/quasarframework/quasar-ui-qmarkdown/commit/b61dff84851c45369cf931db5bd93db177c657f6
Restart Required: No
Instructions:
1. Update package.json to specify 'quasar-ui-qmarkdown': '^2.0.5'. 2. Run npm update quasar-ui-qmarkdown or yarn upgrade quasar-ui-qmarkdown. 3. Rebuild and redeploy your application.
🔧 Temporary Workarounds
Input Sanitization
allImplement server-side sanitization of all markdown content before passing to QMarkdown component
Content Security Policy
allImplement strict CSP headers to mitigate script execution even if XSS occurs
🧯 If You Can't Patch
- Implement strict input validation to reject markdown headers containing script-like patterns
- Use alternative markdown rendering libraries that are not vulnerable
🔍 How to Verify
Check if Vulnerable:
Check package.json or node_modules/quasar-ui-qmarkdown/package.json for version less than 2.0.5Check Version:
npm list quasar-ui-qmarkdown | grep quasar-ui-qmarkdownVerify Fix Applied:
Verify installed version is 2.0.5 or higher and test that header XSS is properly sanitized📡 Detection & Monitoring
Log Indicators:
- Unusual markdown header patterns in user content
- Multiple failed attempts to inject script-like content
Network Indicators:
- Unexpected script tags in markdown-rendered content
- External resource loading from markdown headers
SIEM Query:
source="web_app" AND (message="*<script*" OR message="*javascript:*") AND component="qmarkdown"