Executive brief
@tiptap/extension-link is a JavaScript library component used in rich text editors to manage hyperlinks. The vulnerability allows attackers to inject malicious JavaScript code (e.g., via javascript: URLs) into links, which executes when users interact with those links. This can lead to session hijacking, credential theft, or other client-side attacks against end users.
Technical details
This is a Cross-site Scripting (CWE-79) vulnerability in @tiptap/extension-link versions before 2.10.4. The root cause is insufficient sanitization of user input when setting or toggling links; specifically, the link commands did not respect XSS prevention via allowed protocol filtering. An attacker with the ability to inject link data can craft a javascript: URL payload that executes arbitrary code in the victim's browser context. The attack requires user interaction (clicking the malicious link) and network access to the affected application. The fix, released in version 2.10.4, enforces allowed protocol validation in link command handling.
Affected products
- Tiptap extension-link before 2.10.4
Timeline
- 2025-12-09: disclosed
- 2025-12-09: patched: Fixed in version 2.10.4