Description
QMarkdown (aka quasar-ui-qmarkdown) before 2.0.5 allows XSS via headers even when when no-html is set.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Quasar | QMarkdown | < 2.0.5 | 2.0.5 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | @quasar/quasar-ui-qmarkdown | < 2.0.5 | 2.0.5 | GHSA-wm65-ph3w-587c |