Vendor
3 published CVES affecting tiptap, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).
Newest publication first
Summary @tiptap/core contains two quadratic regular-expression denial-of-service paths in its default Markdown attribute parsers. Pandoc-style block attributes use two unanchored greedy expressions that rescan repeated __QUOTED_0 prefixes. Inline shortcode attributes use another...
Summary @tiptap/core's public mergeAttributes() helper uses ordinary bracket assignment on keys returned by Object.entries(). An own __proto__ key from JSON therefore invokes the legacy prototype setter on the fresh merged object. The function returns an object whose prototype is...
Versions of the package @tiptap/extension-link before 2.10.4 are vulnerable to Cross-site Scripting (XSS) due to unsanitized user input allowed in setting or toggling links. An attacker can execute arbitrary JavaScript code in the context of the application by injecting a javascr...
Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.