CVE-2025-14284
📋 TL;DR
This vulnerability allows attackers to execute arbitrary JavaScript code in web applications using vulnerable versions of the @tiptap/extension-link package. Attackers can inject malicious javascript: URLs into link attributes, which execute when users interact with the links. This affects any application using @tiptap/extension-link before version 2.10.4.
💻 Affected Systems
- @tiptap/extension-link
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete account takeover, session hijacking, data theft, or malware distribution through the compromised application.
Likely Case
Session hijacking, credential theft, or defacement of user-facing content.
If Mitigated
Limited impact with proper Content Security Policy (CSP) headers and input validation in place.
🎯 Exploit Status
Exploitation requires user interaction with malicious links but is straightforward to implement.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.10.4
Vendor Advisory: https://github.com/ueberdosis/tiptap/releases/tag/v2.10.4
Restart Required: No
Instructions:
1. Update @tiptap/extension-link to version 2.10.4 or later using npm/yarn/pnpm. 2. Run npm update @tiptap/extension-link or equivalent. 3. Rebuild and redeploy your application.
🔧 Temporary Workarounds
Input Sanitization
allImplement server-side validation to reject javascript: URLs and other dangerous protocols in link inputs.
Content Security Policy
allImplement strict CSP headers to block inline JavaScript execution.
🧯 If You Can't Patch
- Disable user-generated links in the editor or implement strict URL validation.
- Implement network segmentation and monitoring for suspicious outbound connections.
🔍 How to Verify
Check if Vulnerable:
Check package.json for @tiptap/extension-link version. If version is below 2.10.4, you are vulnerable.Check Version:
npm list @tiptap/extension-linkVerify Fix Applied:
Verify package.json shows @tiptap/extension-link version 2.10.4 or higher.📡 Detection & Monitoring
Log Indicators:
- Unusual JavaScript execution events in browser console logs
- Suspicious URL patterns containing javascript: protocol
Network Indicators:
- Unexpected outbound connections from the application to external domains
SIEM Query:
source="web_server" AND (javascript: OR data: OR vbscript:) IN url🔗 References
- https://gist.github.com/th4s1s/3d1b6cd3e7257b14947242f712ec6e1f
- https://github.com/ueberdosis/tiptap/commit/1c2fefe3d61ab1c8fbaa6d6b597251e1b6d9aaed
- https://github.com/ueberdosis/tiptap/releases/tag/v2.10.4
- https://security.snyk.io/vuln/SNYK-JS-TIPTAPEXTENSIONLINK-14222197
- https://gist.github.com/th4s1s/3d1b6cd3e7257b14947242f712ec6e1f
