AIKIDO-2024-10075
@tiptap/extension-youtube is vulnerable to Cross-site Scripting (XSS)
15
Low Risk
This Affects:
@tiptap/extension-youtubeTL;DR
Affected versions of the @tiptap/extension-youtube library are vulnerable to Cross-site Scripting (XSS) due to a flaw in the getEmbedUrlFromYoutubeUrl function. An attacker can craft a response that stores a YouTube video with a URL containing /embed/, such as javascript:alert(1)//embed/, allowing arbitrary code execution in the site's origin. This vulnerability is considered low severity, as exploiting it would require the attacker to manipulate the TipTap payload in a way that bypasses the YouTube extension's setYoutubeVideo command, which already validates URLs.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
@tiptap/extension-youtube is vulnerable to Cross-site Scripting (XSS) in versions 2.0.0 - 2.1.12.
How to fix this
Upgrade the @tiptap/extension-youtube library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant