Listen to this Post
The vulnerability in @tiptap/extension-link before version 2.10.4 is a DOM-based Cross-site Scripting (XSS) flaw. It originates from the extension’s failure to properly sanitize user-supplied input when creating or modifying hyperlinks within the TipTap editor. An attacker can exploit this by injecting a malicious `javascript:` URL as the link’s `href` attribute. For example, a payload like `javascript:alert(document.cookie)` can be embedded. This payload is stored within the editor’s content. The malicious code executes in the victim’s browser context when they interact with the tampered link, such as by clicking on it. The attack requires user interaction (UI:A in CVSS), limiting automatic execution but not the potential damage. The core issue is the lack of validation or sanitization on the input passed to the link extension’s `setLink` or `toggleLink` commands, allowing arbitrary protocol schemes. This bypasses standard HTML sanitization that might only filter tags like <script>. The CVSS 4.0 vector is AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N, scoring 5.1 (MEDIUM). It impacts the Confidentiality and Integrity of the application session and some user data. The vulnerability is particularly relevant in applications where untrusted users can submit or edit content that uses this TipTap extension.
Platform: @tiptap/extension-link
Version: < 2.10.4
Vulnerability: DOM-based XSS
Severity: Medium
Date: 2025-12-09
Prediction: 2025-12-16
What Undercode Say:
npm list @tiptap/extension-link Check for vulnerable versions below 2.10.4 grep -r "setLink|toggleLink" src/ Find usage of vulnerable methods npm audit Scan for known vulnerabilities
How Exploit:
- Attacker injects a `javascript:` URL into editor link.
2. Payload saved to application database/storage.
3. Victim views page containing the malicious link.
4. Victim clicks the link, executing the payload.
5. Attacker’s script runs in victim’s session context.
Protection from this CVE
- Upgrade to version 2.10.4+.
- Implement client-side input sanitization.
- Use Content Security Policy (CSP).
- Validate all link `href` protocols.
Impact
- Arbitrary JavaScript execution.
- Session hijacking.
- Data theft from the page.
- Application integrity compromise.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
