{"answers":{"affected":"2 open source packages ship an affected version, including @tiptap/core.","exploited":"There is no known exploitation of GHSA-cp6q-959q-f8rh in the wild and no public exploit code.","fix":"Upgrade @tiptap/core to 3.30.4 or later.","what":"GHSA-cp6q-959q-f8rh is a cross-site scripting vulnerability in @tiptap/core, published on 2 Sep 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link."},"fix_prompt":"Check this codebase for GHSA-cp6q-959q-f8rh and fix it if it is affected.\n\nWhat it is: GHSA-cp6q-959q-f8rh is a cross-site scripting vulnerability in @tiptap/core, published on 2 Sep 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.\nExploitation: There is no known exploitation of GHSA-cp6q-959q-f8rh in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- @tiptap/core (npm): affected from 2.0.0-alpha.0; fixed in 3.30.4\n- @tiptap/core (npm): affected from 2.0.0-alpha.0; fixed in 3.30.4\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/GHSA-cp6q-959q-f8rh/ (Markdown: https://insights.sbomify.com/GHSA-cp6q-959q-f8rh/index.md)","id":"GHSA-cp6q-959q-f8rh","markdown":"https://insights.sbomify.com/GHSA-cp6q-959q-f8rh/index.md","name":"GHSA-cp6q-959q-f8rh","record":{"aliases":[],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["code_execution"],"network_reachable":"yes","non_default_config":false,"product_category":"Tiptap editor library","requires_auth":"none","summary":"Attackers can inject malicious attributes via prototype pollution in mergeAttributes, leading to Cross-Site Scripting (XSS) when rendered in the browser.","user_interaction":"required","vuln_class":"xss"},"analysis_generated_by":"qwen3.8-flash-next","assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"## Summary\n\n`@tiptap/core`'s public `mergeAttributes()` helper uses ordinary bracket assignment on keys returned by `Object.entries()`. An own `__proto__` key from JSON therefore invokes the legacy prototype setter on the fresh merged object. The function returns an object whose prototype is attacker-controlled, while `Object.keys()` and ordinary own-property checks show no attacker attributes.\n\nWhen that result is used as a ProseMirror DOMOutputSpec attribute object, `prosemirror-model`'s `DOMSerializer.renderSpec()` enumerates it with `for...in` and applies inherited values with `setAttribute()`. In a browser proof, inherited `src` and `onerror` values were copied to an `\u003cimg\u003e` and the error handler executed once. This is per-object prototype manipulation; the proof does not modify global `Object.prototype`.\n\n## Root cause\n\nThe affected loop is conceptually:\n\n```ts\nconst mergedAttributes = { ...items }\nfor (const [key, value] of Object.entries(item)) {\n  const exists = mergedAttributes[key]\n  // ...\n  mergedAttributes[key] = value\n}\n```\n\n`Object.entries(JSON.parse('{\"__proto__\": {...}}'))` includes `__proto__`. Reading `mergedAttributes['__proto__']` resolves the inherited `Object.prototype`; assigning to the same key invokes `Object.prototype.__proto__`'s setter and replaces `mergedAttributes`' prototype.\n\n## Browser reproduction\n\nThe following shape was tested with exact `@tiptap/core` 3.29.2 and `prosemirror-model` 1.25.11:\n\n```js\nconst input = JSON.parse(`{\n  \"__proto__\": {\n    \"data-inherited-canary\": \"present\",\n    \"src\": \"x-invalid://canary\",\n    \"onerror\": \"globalThis.__tiptapXss += 1\"\n  }\n}`)\n\nconst attrs = mergeAttributes(input)\n// Object.keys(attrs) === []\n// Object.getPrototypeOf(attrs) === input.__proto__\n\nconst schema = new Schema({\n  nodes: {\n    doc: { content: 'image' },\n    image: { toDOM: () =\u003e ['img', attrs] },\n    text: {},\n  },\n})\nconst doc = schema.node('doc', null, [schema.node('image')])\nconst fragment = DOMSerializer.fromSchema(schema).serializeFragment(doc.content)\ndocument.body.append(fragment)\n```\n\nChromium produced an image with `data-inherited-canary`, `src`, and `onerror`; the handler executed exactly once. `Object.prototype` remained clean.\n\n## Impact and preconditions\n\nApplications that merge untrusted imported document, plugin, CMS, API, tenant, or AI-derived attribute objects can receive a prototype-manipulated result. Consumers that enumerate inherited keys, including ProseMirror's DOM serializer, can turn the hidden properties into DOM attributes and execute JavaScript in the application's origin. Own-key validation, object spread, JSON serialization, and logging can miss the inherited values. Other component consumers can read inherited authorization or configuration fields.\n\nTiptap's standard fixed ProseMirror schemas discard unknown document attributes, so arbitrary Tiptap JSON is not automatically exploitable in every application. A vulnerable application needs an untrusted object boundary into `mergeAttributes()` or a dynamic/custom extension or schema that preserves the relevant attribute object.\n\n## Affected versions\n\nThe unsafe assignment was introduced in commit `ecadf7ea0a7f8f39a8496a60edf0ac8f379e6eb3` and is present in the first package tag `@tiptap/core@2.0.0-alpha.0`, v2.0.0, v2.27.1, v3.0.0, and current v3.29.2 source. No fixed release was found.\n\n## Recommended remediation\n\nReject `__proto__` before reading or assigning the key, or define copied keys as own data properties without invoking legacy setters. A minimal hardening is to skip `key === '__proto__'`. Add regression tests using an own JSON-origin `__proto__` key and assert that the result keeps `Object.prototype` as its prototype, exposes no inherited attacker keys, and cannot create an event-handler attribute through `DOMSerializer`.\n\nThis was found during authorized dependency review and is being reported privately. No public zero-day issue has been opened.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":true,"headline":"Tiptap: mergeAttributes() turns an own __proto__ key into inherited executable DOM attributes","id":"GHSA-cp6q-959q-f8rh","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":"npm","product":null,"products":[],"type":"xss","year":"2026"},"n_packages":2,"n_references":null,"packages":[{"ecosystem":"npm","fixed":["3.30.4"],"introduced":["2.0.0-alpha.0"],"last_affected":[],"package":"@tiptap/core","purl":null,"source":"GHSA-cp6q-959q-f8rh"},{"ecosystem":"npm","fixed":["3.30.4"],"introduced":["2.0.0-alpha.0"],"last_affected":[],"package":"@tiptap/core","purl":"pkg:npm/%40tiptap/core","source":"GHSA-cp6q-959q-f8rh"}],"products":null,"published":"2026-09-02","related":[],"sources":[{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":"Attackers can inject malicious attributes via prototype pollution in mergeAttributes, leading to Cross-Site Scripting (XSS) when rendered in the browser.","url":"https://insights.sbomify.com/GHSA-cp6q-959q-f8rh/"}