Skip to content
OpenAdvisories

Package · npm

@tiptap/core

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Medium —
    GHSA-cp6q-959q-f8rh

    Tiptap: mergeAttributes() turns an own __proto__ key into inherited executable DOM attributes

    ## Summary `@tiptap/core`'s public `mergeAttributes()` helper uses ordinary bracket assignment on keys returned by `Object.entries()`. An own `__proto__` key from JSON therefore invokes the legacy prototype setter on the fresh merged object. The function retu…

    @tiptap/core npm