{"action":"Upgrade @tiptap/extension-link to 2.10.4 or later.","affected":[{"fixed":"2.10.4","introduced":"0"}],"component":"@tiptap/extension-link","cve_ids":["CVE-2025-14284"],"ecosystem":"npm","epss":0.00368,"exploited":false,"fixed_versions":["2.10.4"],"ghsa_id":"GHSA-vhrc-hgrq-x75r","id":"tcs_01M5KGC1JP4J43EAT4PFWB49Z3","modified_at":"2025-12-10T00:41:15.991503Z","published_at":"2025-12-09T18:30:35Z","references":["https://osv.dev/vulnerability/GHSA-vhrc-hgrq-x75r","https://nvd.nist.gov/vuln/detail/CVE-2025-14284","https://github.com/ueberdosis/tiptap/commit/1c2fefe3d61ab1c8fbaa6d6b597251e1b6d9aaed","https://gist.github.com/th4s1s/3d1b6cd3e7257b14947242f712ec6e1f","https://github.com/ueberdosis/tiptap","https://github.com/ueberdosis/tiptap/releases/tag/v2.10.4","https://security.snyk.io/vuln/SNYK-JS-TIPTAPEXTENSIONLINK-14222197"],"severity":{"label":"medium","score":6.1},"sources":[{"source":"osv","source_id":"GHSA-vhrc-hgrq-x75r","url":"https://osv.dev/vulnerability/GHSA-vhrc-hgrq-x75r"}],"summary":"@tiptap/extension-link vulnerable to Cross-site Scripting (XSS)"}