Cross-site Scripting Vulnerability in @tiptap/extension-link by ueberdosis

CVE-2025-14284

What is CVE-2025-14284?

The @tiptap/extension-link package before version 2.10.4 is susceptible to Cross-site Scripting (XSS) attacks due to inadequate input sanitization. This vulnerability allows attackers to inject malicious JavaScript code via unsanitized link attributes. When the affected links are interacted with by users, the injected code can be executed, potentially compromising the security and integrity of the web application.

References