{"id":"EUVD-2025-201879","enisaUuid":"8e489f52-da0e-377c-b83e-01160e3b3a0b","description":"Versions of the package @tiptap/extension-link before 2.10.4 are vulnerable to Cross-site Scripting (XSS) due to unsanitized user input allowed in setting or toggling links. An attacker can execute arbitrary JavaScript code in the context of the application by injecting a javascript: URL payload into these attributes, which is then triggered either by user interaction.","datePublished":"Dec 9, 2025, 5:00:03 AM","dateUpdated":"Dec 9, 2025, 2:59:53 PM","baseScore":5.1,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N/E:P","references":"https://security.snyk.io/vuln/SNYK-JS-TIPTAPEXTENSIONLINK-14222197\nhttps://gist.github.com/th4s1s/3d1b6cd3e7257b14947242f712ec6e1f\nhttps://github.com/ueberdosis/tiptap/commit/1c2fefe3d61ab1c8fbaa6d6b597251e1b6d9aaed\nhttps://github.com/ueberdosis/tiptap/releases/tag/v2.10.4\n","aliases":"CVE-2025-14284\nGHSA-vhrc-hgrq-x75r\n","assigner":"snyk","epss":0.37,"enisaIdProduct":[{"id":"07840eba-82cd-3173-a591-85b11dcb6e74","product":{"name":"@tiptap/extension-link","vendor":{"name":"n/a"}},"product_version":"0 \u003c2.10.4"}],"enisaIdVendor":[{"id":"0bebcf87-20bb-3442-8ec0-99ef84449644","vendor":{"name":"n/a"}}],"enisaIdVulnerability":[{"id":"68b6a2fc-a993-307b-b08a-b87ccddff2d3","vulnerability":{"id":"CVE-2025-14284","description":"Versions of the package @tiptap/extension-link before 2.10.4 are vulnerable to Cross-site Scripting (XSS) due to unsanitized user input allowed in setting or toggling links. An attacker can execute arbitrary JavaScript code in the context of the application by injecting a javascript: URL payload into these attributes, which is then triggered either by user interaction.","datePublished":"Dec 9, 2025, 5:00:03 AM","dateUpdated":"Dec 9, 2025, 2:59:53 PM","status":"PUBLISHED","baseScore":5.1,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N/E:P","references":"https://security.snyk.io/vuln/SNYK-JS-TIPTAPEXTENSIONLINK-14222197\nhttps://gist.github.com/th4s1s/3d1b6cd3e7257b14947242f712ec6e1f\nhttps://github.com/ueberdosis/tiptap/commit/1c2fefe3d61ab1c8fbaa6d6b597251e1b6d9aaed\nhttps://github.com/ueberdosis/tiptap/releases/tag/v2.10.4\n","enisa_id":"EUVD-2025-201879\n","assigner":"snyk","epss":0.37,"dataProcessed":"Oct 31, 2026, 7:16:50 AM","vulnerabilityProduct":[{"id":"54698220-8674-375c-8260-2aa70fefa180","product":{"name":"@tiptap/extension-link","vendor":{"name":"n/a"}},"product_version":"0 \u003c2.10.4"}],"vulnerabilityVendor":[{"id":"9e5498c6-cece-321c-a83f-ed77310e2f91","vendor":{"name":"n/a"}}]}},{"id":"b8dbc8be-37d7-3f02-9db3-dff64dcf84c3","vulnerability":{"id":"GHSA-vhrc-hgrq-x75r","description":"@tiptap/extension-link vulnerable to Cross-site Scripting (XSS)","datePublished":"Dec 9, 2025, 6:30:35 PM","dateUpdated":"Dec 10, 2025, 12:01:26 AM","baseScore":0.0,"references":"https://nvd.nist.gov/vuln/detail/CVE-2025-14284\nhttps://github.com/ueberdosis/tiptap/commit/1c2fefe3d61ab1c8fbaa6d6b597251e1b6d9aaed\nhttps://gist.github.com/th4s1s/3d1b6cd3e7257b14947242f712ec6e1f\nhttps://github.com/ueberdosis/tiptap\nhttps://github.com/ueberdosis/tiptap/releases/tag/v2.10.4\nhttps://security.snyk.io/vuln/SNYK-JS-TIPTAPEXTENSIONLINK-14222197\n","enisa_id":"EUVD-2025-201879\n","aliases":"CVE-2025-14284\nGHSA-vhrc-hgrq-x75r\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:52:34 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}