@lexical/link

This package contains the functionality for Lexical links.

Latest 0.52.0

NPM

78%

Total Score

healthy

Healthy, with workflow hygiene concerns from high-confidence template-injection findings and unpinned actions.

Are you affected? Scan for Free

Health Score Breakdown

Repo package mention

The repository name does not match @lexical/link and its README does not mention the package, creating some uncertainty about package-specific ownership even though a monorepo can explain the mismatch.

Version stability

Version 0.52.0 is not a prerelease, but 90% of recent releases were prereleases, so consumers should expect a less settled API surface.

Workflow audit

All 13 workflows were analyzed, but all 16 action references are unpinned, two workflows grant top-level write access, and high-confidence template-injection findings were reported. No untrusted checkout or script-injection trigger was found, so this is a hygiene concern rather than a standalone severe risk.

Vulnerabilities

Title	Versions	Severity
AIKIDO-2026-152211 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. @lexical/link is vulnerable to Cross-site Scripting (XSS) in versions 0.11.0 - 0.47.0.	0.11.0 - 0.47.0	Medium

Package versions

Maintainers

Direct Dependencies

Dependency	Last Release	Score
lexical Version 0.52.0	—	—
@lexical/a11y Version 0.52.0	—	—
@lexical/html Version 0.52.0	—	—
@lexical/utils Version 0.52.0	—	—
@lexical/internal Version 0.52.0	—	—