Versions of the package @tiptap/extension-link before 2.10.4 are vulnerable to Cross-site Scripting (XSS) due to unsanitized user input allowed in setting or toggling links. An attacker can execute arbitrary JavaScript code in the context o…

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2025-14284 · Microsoft / collected KEV context

EUVD-2025-201879

GHSA-vhrc-hgrq-x75r

cve-program · CVE-2025-14284

• https://security.snyk.io/vuln/SNYK-JS-TIPTAPEXTENSIONLINK-14222197
• https://gist.github.com/th4s1s/3d1b6cd3e7257b14947242f712ec6e1f
• https://github.com/ueberdosis/tiptap/commit/1c2fefe3d61ab1c8fbaa6d6b597251e1b6d9aaed
• https://github.com/ueberdosis/tiptap/releases/tag/v2.10.4

euvd · EUVD-2025-201879

• https://security.snyk.io/vuln/SNYK-JS-TIPTAPEXTENSIONLINK-14222197
• https://gist.github.com/th4s1s/3d1b6cd3e7257b14947242f712ec6e1f
• https://github.com/ueberdosis/tiptap/commit/1c2fefe3d61ab1c8fbaa6d6b597251e1b6d9aaed
• https://github.com/ueberdosis/tiptap/releases/tag/v2.10.4

nvd · CVE-2025-14284

• https://gist.github.com/th4s1s/3d1b6cd3e7257b14947242f712ec6e1f
• https://github.com/ueberdosis/tiptap/commit/1c2fefe3d61ab1c8fbaa6d6b597251e1b6d9aaed
• https://github.com/ueberdosis/tiptap/releases/tag/v2.10.4
• https://security.snyk.io/vuln/SNYK-JS-TIPTAPEXTENSIONLINK-14222197

osv · GHSA-vhrc-hgrq-x75r

• https://nvd.nist.gov/vuln/detail/CVE-2025-14284
• https://github.com/ueberdosis/tiptap/commit/1c2fefe3d61ab1c8fbaa6d6b597251e1b6d9aaed
• https://gist.github.com/th4s1s/3d1b6cd3e7257b14947242f712ec6e1f
• https://github.com/ueberdosis/tiptap
• https://github.com/ueberdosis/tiptap/releases/tag/v2.10.4
• https://security.snyk.io/vuln/SNYK-JS-TIPTAPEXTENSIONLINK-14222197

No related operational record is retained in the current change model.