GitHub Advisoryadvisory · npm

GHSA-vhrc-hgrq-x75r @tiptap/extension-link vulnerable to Cross-site Scripting (XSS)

LOW Published 2025-12-09 Modified 2025-12-10 Official page ↗
Aliases
CVE-2025-14284
Ecosystem
npm
Packages
@tiptap/extension-link
Severity
Low
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2025-12-10

Affected packages

• npm @tiptap/extension-link: < 2.10.4 → fixed in 2.10.4

Description

Versions of the package @tiptap/extension-link before 2.10.4 are vulnerable to Cross-site Scripting (XSS) due to unsanitized user input allowed in setting or toggling links. An attacker can execute arbitrary JavaScript code in the context of the application by injecting a javascript: URL payload into these attributes, which is then triggered either by user interaction.

Related

Alias · CVE (1)

  • CVE-2025-14284 Versions of the package @tiptap/extension-link before 2.10.4 are vulnerable to Cross-site Scripting (XSS) due to unsanitized user input… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References