GHSA-cp6q-959q-f8rh

Medium

Published: —Translated: 22/10/2026(UTC)NVD NIST

Summary

@tiptap/core's public mergeAttributes() helper uses ordinary bracket assignment on keys returned by Object.entries(). An own __proto__ key from JSON therefore invokes the legacy prototype setter on the fresh merged object, and the function returns an object whose prototype is attacker-controlled.

Risk Assessment

This may lead to prototype pollution, potentially enabling security bypass or unintended code execution in the application.

Recommendation

Update @tiptap/core to a patched version and avoid passing untrusted data to mergeAttributes().

Other vulnerabilities in @tiptap/core

GHSA-j95f-988m-3j2fHigh
@tiptap/core contains two quadratic regular-expression denial-of-service paths in its default Markdown attribute parsers. Pandoc-style block attributes use two unanchored greedy expressions that rescan repeated __QUOTED_0 prefixes. Inline shortcode attributes use another unanchored expression, which can lead to resource exhaustion.

Original NVD description (English source)

## Summary `@tiptap/core`'s public `mergeAttributes()` helper uses ordinary bracket assignment on keys returned by `Object.entries()`. An own `__proto__` key from JSON therefore invokes the legacy prototype setter on the fresh merged object. The function returns an object whose prototype is attacke

Vulnerability data from NVD (NIST) · CISA KEV · EPSS