Skip to content
OpenAdvisories

Package · npm

@tiptap/core

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • High —
    GHSA-j95f-988m-3j2f

    Tiptap: Quadratic ReDoS in block and inline Markdown attribute parsing

    ## Summary `@tiptap/core` contains two quadratic regular-expression denial-of-service paths in its default Markdown attribute parsers. Pandoc-style block attributes use two unanchored greedy expressions that rescan repeated `__QUOTED_0` prefixes. Inline short…

    @tiptap/core npm
  • Medium —
    GHSA-cp6q-959q-f8rh

    Tiptap: mergeAttributes() turns an own __proto__ key into inherited executable DOM attributes

    ## Summary `@tiptap/core`'s public `mergeAttributes()` helper uses ordinary bracket assignment on keys returned by `Object.entries()`. An own `__proto__` key from JSON therefore invokes the legacy prototype setter on the fresh merged object. The function retu…

    @tiptap/core npm