ueberdosis/tiptap

Releases6.57K

Frequency10 hours

Last Release 8 days ago

Stars37.4K

The headless rich text editor framework for web artisans.

CVE History

CVE	Published	CVSS v3	CVSS v2
CVE-2025-14284 ↗	Dec 9, 2025Tuesday, 9 December 2025, 16:17	6.1 MEDIUM	—
Versions of the package @tiptap/extension-link before 2.10.4 are vulnerable to Cross-site Scripting (XSS) due to unsanitized user input allowed in setting or toggling links. An attacker can execute arbitrary JavaScript code in the context of the application by injecting a javascript: URL payload into these attributes, which is then triggered either by user interaction.