{"data":{"id":"7df5424c-e3c8-4e15-a242-a92f4dc44d03","title":"GHSA-cp6q-959q-f8rh: Tiptap: mergeAttributes() turns an own __proto__ key into inherited executable DOM attributes","summary":"A bug in Tiptap's mergeAttributes() function allows attackers to manipulate an object's prototype (the internal template that defines inherited properties) by passing a JSON object with a `__proto__` key. When this manipulated object is used to create DOM elements in ProseMirror (a document editing library), the hidden inherited properties can be converted into HTML attributes like event handlers, potentially allowing attackers to run malicious JavaScript code.","solution":"The source recommends: 'Reject `__proto__` before reading or assigning the key, or define copied keys as own data properties without invoking legacy setters. A minimal hardening is to skip `key === '__proto__'`. Add regression tests using an own JSON-origin `__proto__` key and assert that the result keeps `Object.prototype` as its prototype, exposes no inherited attacker keys, and cannot create an event-handler attribute through `DOMSerializer`.' No fixed release version is mentioned in the source.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-cp6q-959q-f8rh","publishedAt":"2026-09-02T14:44:39.000Z","cveId":null,"cweIds":null,"cvssScore":null,"cvssSeverity":"medium","severity":"medium","attackType":["supply_chain"],"issueType":"vulnerability","affectedPackages":["@tiptap/core@>= 2.0.0-alpha.0, < 3.30.4 (fixed: 3.30.4)"],"affectedVendors":["LangChain"],"affectedVendorsRaw":["Tiptap","@tiptap/core","ProseMirror"],"classifierModel":"claude-haiku-4-5-20251001","classifierPromptVersion":"v3","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":null,"epssScore":null,"patchAvailable":true,"disclosureDate":"2026-09-02T14:44:39.000Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["integrity","confidentiality"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.75,"researchCategory":null,"atlasIds":null}}