Description
@tiptap/core’s public mergeAttributes() helper uses ordinary bracket assignment on keys returned by Object.entries(). An own __proto__ key from JSON therefore invokes the legacy prototype setter on the fresh merged object. The function returns an object whose prototype is attacker-controlled, while Object.keys() and ordinary own-property checks show no attacker attributes.
Recommendation
Update the @tiptap/core package to the latest compatible version. Followings are version details:
- Affected version(s): >= 2.0.0-alpha.0, < 3.30.4
- Patched version(s): 3.30.4
References
Could your website be exposed too?
SmartScanner can check your website for Tiptap: mergeAttributes() turns an own __proto__ key into inherited executable DOM attributes and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Sveltejs devalue's `devalue.parse` and `devalue.unflatten` emit objects with `__proto__` own properties - Vulnerability
- Tiptap: Quadratic ReDoS in block and inline Markdown attribute parsing - Vulnerability
- devalue: Malformed null-prototype object keys bypass __proto__ rejection via property-key coercion - Vulnerability
- mcp-data-vis vulnerable to denial of service via unsanitized `select` key lookup on `Object.prototype` with `precompile: - Vulnerability
You might also like:
See something that needs correcting? Let us knowUpdated September 02, 2026