---
id: CVE-2025-14284
title: >-
  Versions of the package @tiptap/extension-link before 2.10.4 are vulnerable to
  Cross-site Scripting (XSS) due to unsanitized user input allowed in setting or
  toggling links
summary: >-
  Versions of the package @tiptap/extension-link before 2.10.4 are vulnerable to
  Cross-site Scripting (XSS) due to unsanitized user input allowed in setting or
  toggling links. An attacker can execute arbitrary JavaScript code in the
  contex…
severity: medium
cvss: 6.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'
cwe:
  - CWE-79
vendor: tiptap
product: tiptap/extension-link
affected:
  - tiptap/extension-link < 2.10.4
patched:
  - tiptap/extension-link 2.10.4
published: '2025-12-09'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T22:10:00.210'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-14284'
references:
  - url: 'https://gist.github.com/th4s1s/3d1b6cd3e7257b14947242f712ec6e1f'
    label: report@snyk.io
  - url: >-
      https://github.com/ueberdosis/tiptap/commit/1c2fefe3d61ab1c8fbaa6d6b597251e1b6d9aaed
    label: report@snyk.io
  - url: 'https://github.com/ueberdosis/tiptap/releases/tag/v2.10.4'
    label: report@snyk.io
  - url: 'https://security.snyk.io/vuln/SNYK-JS-TIPTAPEXTENSIONLINK-14222197'
    label: report@snyk.io
  - url: 'https://gist.github.com/th4s1s/3d1b6cd3e7257b14947242f712ec6e1f'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
epss: 0.00368
epssPercentile: 0.29018
ingestedAt: '2026-10-14T23:00:02.029Z'
---

## Overview

Versions of the package @tiptap/extension-link before 2.10.4 are vulnerable to Cross-site Scripting (XSS) due to unsanitized user input allowed in setting or toggling links. An attacker can execute arbitrary JavaScript code in the context of the application by injecting a javascript: URL payload into these attributes, which is then triggered either by user interaction.

## Affected

- `tiptap/extension-link < 2.10.4`

## Remediation

Upgrade past the affected range:

- `tiptap/extension-link 2.10.4`