Описание
Versions of the package @tiptap/extension-link before 2.10.4 are vulnerable to Cross-site Scripting (XSS) due to unsanitized user input allowed in setting or toggling links. An attacker can execute arbitrary JavaScript code in the context of the application by injecting a javascript: URL payload into these attributes, which is then triggered either by user interaction.
A flaw was found in @tiptap/extension-link. This vulnerability allows an attacker to execute arbitrary JavaScript (JS) code via unsanitized user input when setting or toggling links, by injecting a javascript: Uniform Resource Locator (URL) payload.
Отчет
This vulnerability is rated Moderate for Red Hat products as it involves a Cross-site Scripting (XSS) flaw in the @tiptap/extension-link component. Exploitation requires user interaction with a specially crafted link containing a 'javascript:' URL payload. The impact is limited to the user's browser session.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Ссылки на источники
Дополнительная информация
Статус:
EPSS
6.1 Medium
CVSS3
Связанные уязвимости
Versions of the package @tiptap/extension-link before 2.10.4 are vulnerable to Cross-site Scripting (XSS) due to unsanitized user input allowed in setting or toggling links. An attacker can execute arbitrary JavaScript code in the context of the application by injecting a javascript: URL payload into these attributes, which is then triggered either by user interaction.
@tiptap/extension-link vulnerable to Cross-site Scripting (XSS)
EPSS
6.1 Medium
CVSS3