Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
@tiptap/core contains two quadratic regular-expression denial-of-service paths in its default Markdown attribute parsers. Pandoc-style block attributes use two unanchored greedy expressions that rescan repeated QUOTED0 prefixes. Inline shortcode attributes use another unanchored greedy key expression that rescans a long word-character run when no equals sign follows. The public createAtomBlockMarkdownSpec and createBlockMarkdownSpec helpers call the vulnerable Pandoc-style parser; createInlineMarkdownSpec calls the separately vulnerable shortcode parser. Using unmodified npm 3.29.2, a complete 20,508-byte atom-block token took approximately 1.40 seconds while an equal-length control took 0.29 ms. A complete 32,776-byte inline token took approximately 2.21 seconds while its equal-length control took 0.19 ms. Current repository main commit 5158212970344952dd9918b6a44bfb400d7fb6c1 retains both expressions. Block attribute root cause…
Recommended action: Upgrade to 3.30.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
@tiptap/core's public mergeAttributes() helper uses ordinary bracket assignment on keys returned by Object.entries(). An own proto key from JSON therefore invokes the legacy prototype setter on the fresh merged object. The function returns an object whose prototype is attacker-controlled, while Object.keys() and ordinary own-property checks show no attacker attributes. When that result is used as a ProseMirror DOMOutputSpec attribute object, prosemirror-model's DOMSerializer.renderSpec() enumerates it with for...in and applies inherited values with setAttribute(). In a browser proof, inherited src and onerror values were copied to an <img and the error handler executed once. This is per-object prototype manipulation; the proof does not modify global Object.prototype. Root cause The affected loop is conceptually: Object.entries(JSON.parse('{"proto": {...}}')) includes proto. Reading mergedAttributes['proto'] resolves the inherited Object.prototype; assigning to the same key…
Recommended action: Upgrade to 3.30.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.