CVE-2025-14284

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-14284
Versions of the package @tiptap/extension-link before 2.10.4 are vulnerable to Cross-site Scripting (XSS) due to unsanitized user input allowed in setting or toggling links. An attacker can execute arbitrary JavaScript code in the context of the application by injecting a javascript: URL payload into these attributes, which is then triggered either by user interaction.

6.1 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://gist.github.com/th4s1s/3d1b6cd3e7257b14947242f712ec6e1f Exploit Third Party Advisory
https://github.com/ueberdosis/tiptap/commit/1c2fefe3d61ab1c8fbaa6d6b597251e1b6d9aaed Patch
https://github.com/ueberdosis/tiptap/releases/tag/v2.10.4 Release Notes
https://security.snyk.io/vuln/SNYK-JS-TIPTAPEXTENSIONLINK-14222197 Third Party Advisory
https://gist.github.com/th4s1s/3d1b6cd3e7257b14947242f712ec6e1f Exploit Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:tiptap:tiptap\/extension-link:*:*:*:*:*:node.js:*:*
History

31 Dec 2025, 01:12

Type Values Removed Values Added
CPE cpe:2.3:a:tiptap:extension-link:*:*:*:*:*:node.js:*:* cpe:2.3:a:tiptap:tiptap\/extension-link:*:*:*:*:*:node.js:*:*
First Time Tiptap tiptap\/extension-link

11 Dec 2025, 17:19

Type Values Removed Values Added
First Time Tiptap extension-link
Tiptap
References () https://gist.github.com/th4s1s/3d1b6cd3e7257b14947242f712ec6e1f - () https://gist.github.com/th4s1s/3d1b6cd3e7257b14947242f712ec6e1f - Exploit, Third Party Advisory
References () https://github.com/ueberdosis/tiptap/commit/1c2fefe3d61ab1c8fbaa6d6b597251e1b6d9aaed - () https://github.com/ueberdosis/tiptap/commit/1c2fefe3d61ab1c8fbaa6d6b597251e1b6d9aaed - Patch
References () https://github.com/ueberdosis/tiptap/releases/tag/v2.10.4 - () https://github.com/ueberdosis/tiptap/releases/tag/v2.10.4 - Release Notes
References () https://security.snyk.io/vuln/SNYK-JS-TIPTAPEXTENSIONLINK-14222197 - () https://security.snyk.io/vuln/SNYK-JS-TIPTAPEXTENSIONLINK-14222197 - Third Party Advisory
CPE cpe:2.3:a:tiptap:extension-link:*:*:*:*:*:node.js:*:*

09 Dec 2025, 16:17

Type Values Removed Values Added
New CVE
Information

Published : 2025-12-09 16:17

Updated : 2025-12-31 01:12

NVD link : CVE-2025-14284

Mitre link : CVE-2025-14284

CVE.ORG link : CVE-2025-14284

JSON object : View

Products Affected

tiptap

  • tiptap\/extension-link
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')