Описание
Versions of the package @tiptap/extension-link before 2.10.4 are vulnerable to Cross-site Scripting (XSS) due to unsanitized user input allowed in setting or toggling links. An attacker can execute arbitrary JavaScript code in the context of the application by injecting a javascript: URL payload into these attributes, which is then triggered either by user interaction.
Ссылки
- ExploitThird Party Advisory
- Patch
- Release Notes
- Third Party Advisory
- ExploitThird Party Advisory
Уязвимые конфигурации
Конфигурация 1Версия до 2.10.4 (исключая)
cpe:2.3:a:tiptap:tiptap\/extension-link:*:*:*:*:*:node.js:*:*
EPSS
Процентиль: 14%
0.00046
Низкий
6.1 Medium
CVSS3
Дефекты
CWE-79
Связанные уязвимости
CVSS3: 6.1
github
около 2 месяцев назад
@tiptap/extension-link vulnerable to Cross-site Scripting (XSS)
EPSS
Процентиль: 14%
0.00046
Низкий
6.1 Medium
CVSS3
Дефекты
CWE-79