AIKIDO-2026-484358
@tiptap/core is vulnerable to Denial of Service (DoS)
22
Low Risk
This Affects:
@tiptap/coreTL;DR
The rewriteUnknownContent helper sanitizes untrusted editor JSON by filtering unknown marks and nodes before content is loaded. When marks or content arrays contain null or undefined entries, the helper dereferenced those values and threw a TypeError, aborting sanitization. Applications that call this helper on attacker-controlled JSON could crash the editor workflow or fail to load documents. The fix drops nullish array entries instead of throwing while preserving existing handling for valid marks and nodes.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
@tiptap/core is vulnerable to Denial of Service (DoS) in versions 2.11.0 - 3.26.1.
How to fix this
Upgrade the @tiptap/core library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant