{"id":"CVE-2025-14284","title":"Versions of the package @tiptap/extension-link before 2.10.4 are vulnerable to Cross-site Scripting (XSS) due to unsanitized user input allowed in setting or toggling links","summary":"Versions of the package @tiptap/extension-link before 2.10.4 are vulnerable to Cross-site Scripting (XSS) due to unsanitized user input allowed in setting or toggling links. An attacker can execute arbitrary JavaScript code in the contex…","severity":"medium","cvss":6.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","cwe":["CWE-79"],"vendor":"tiptap","product":"tiptap/extension-link","affected":["tiptap/extension-link < 2.10.4"],"patched":["tiptap/extension-link 2.10.4"],"published":"2025-12-09","updated":"2026-10-14","sourceUpdated":"2026-10-14T22:10:00.210","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-14284","references":[{"url":"https://gist.github.com/th4s1s/3d1b6cd3e7257b14947242f712ec6e1f","label":"report@snyk.io"},{"url":"https://github.com/ueberdosis/tiptap/commit/1c2fefe3d61ab1c8fbaa6d6b597251e1b6d9aaed","label":"report@snyk.io"},{"url":"https://github.com/ueberdosis/tiptap/releases/tag/v2.10.4","label":"report@snyk.io"},{"url":"https://security.snyk.io/vuln/SNYK-JS-TIPTAPEXTENSIONLINK-14222197","label":"report@snyk.io"},{"url":"https://gist.github.com/th4s1s/3d1b6cd3e7257b14947242f712ec6e1f","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"tags":["nvd"],"epss":0.00368,"epssPercentile":0.29018,"ingestedAt":"2026-10-14T23:00:02.029Z","slug":"CVE-2025-14284","body":"## Overview\n\nVersions of the package @tiptap/extension-link before 2.10.4 are vulnerable to Cross-site Scripting (XSS) due to unsanitized user input allowed in setting or toggling links. An attacker can execute arbitrary JavaScript code in the context of the application by injecting a javascript: URL payload into these attributes, which is then triggered either by user interaction.\n\n## Affected\n\n- `tiptap/extension-link < 2.10.4`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `tiptap/extension-link 2.10.4`","depth":"sunlit","depthScore":34,"depthScoreParts":{"impact":33.6,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}