CVE Feed

    Dashboard / CVE / CVE-2025-14284

    CVE-2025-14284

    Versions of the package @tiptap/extension-link before 2.10.4 are vulnerable to Cross-site Scripting (XSS) due to unsanitized user input allowed in setting or toggling links. An attacker can execute arbitrary JavaScript code in the context of the application by injecting a javascript: URL payload into these attributes, which is then triggered either by user interaction.

    Published:Dec 9, 2025
    Last Modified:Dec 31, 2025
    EPS:Dec 9, 2025
    EPSS Score:0.00031
    CVSS Score:6.1

    Affected Products

    Vendor
    Tiptap
    Product
    Tiptap
    Vendor
    Tiptap
    Product
    Tiptap\/extension-link

    Exploits

    https://gist.github.com/th4s1s/3d1b6cd3e7257b14947242f712ec6e1fhttps://gist.github.com/th4s1s/3d1b6cd3e7257b14947242f712ec6e1f

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High