AIKIDO-2026-613639

@tiptap/core is vulnerable to Cross-Site Scripting (XSS)

Cross-Site Scripting (XSS)GHSA-cp6q-959q-f8rh Published 6 days ago

High Risk

This Affects:

@tiptap/core

2.0.0 - 3.30.3

Fixed in 3.30.4

Are you affected? Scan for Free

TL;DR

Affected versions of this package are vulnerable to Cross-Site Scripting (XSS) through the mergeAttributes() helper, which assigns keys from untrusted attribute objects without filtering. Processing content that carries a __proto__ key invokes the legacy prototype setter and pollutes the merged object's prototype with externally controlled values. When that object is later serialized as a ProseMirror DOMOutputSpec, the inherited properties are applied as DOM attributes. The fix defines the copied key as an own data property so untrusted input can no longer alter the object's prototype.

Who does this affect?

You are affected if you are using a version in the vulnerable range and your application merges untrusted or externally influenced attribute objects through mergeAttributes(), whose result is later serialized into the DOM.