Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

ueberdosis/tiptap

              main @ a9efd4d
            

Fixes

CVEs

HIGH

Peak severity

36.4%

Coverage

Highlights

Cross-Site Scripting (XSS): 9 prior fixes. Scrutinize any change in this area.

packages/extension-link/src/link.ts: most-fixed (5 issues). Treat as high-risk during review.

6 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Cross-Site Scripting (XSS): Unsanitized input when setting, toggling, or rendering links allowed attackers to execute arbitrary JavaScript code via crafted protocol schemes like javascript: URIs. This critical gap is also documented under CVE-2025-14284.

Cross-Site Scripting (XSS): Direct assignments to `innerHTML` when parsing elements from string values allowed attackers to execute malicious scripts during content processing, requiring a migration to DOMParser.

Prototype Pollution: A downstream dependency on an insecure version of `linkifyjs` inherited prototype pollution capabilities into the Link extension, which was addressed by upgrading the package.