Description
Versions of the package @tiptap/extension-link before 2.10.4 are vulnerable to Cross-site Scripting (XSS) due to unsanitized user input allowed in setting or toggling links. An attacker can execute arbitrary JavaScript code in the context of the application by injecting a javascript: URL payload into these attributes, which is then triggered either by user interaction.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | @tiptap/extension-link | < 2.10.4 | 2.10.4 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | @tiptap/extension-link | < 2.10.4 | 2.10.4 | GHSA-vhrc-hgrq-x75r |