Versions of the package @tiptap/extension-link before 2.10.4 are vulnerable to Cross-site Scripting (XSS) due to unsanitized user input allowed in setting or toggling links. An attacker can execute arbitrary JavaScript code in the context of the application by injecting a javascript: URL payload into these attributes, which is then triggered either by user interaction.
| Package (Ecosystem) | Introduced | Fixed | Limit |
|---|---|---|---|
| @tiptap/extension-link(npm) | 0 | 2.10.4 | N/A |
CVSS Metrics
