THREATOPS
THREAT OPS › Threat News › [GHSA] GHSA-cp6q-959q-f8rh (medium) — Tiptap: mergeAttributes() turns an own __proto__ key into inherited executable DOM attributes

[GHSA] GHSA-cp6q-959q-f8rh (medium) — Tiptap: mergeAttributes() turns an own __proto__ key into inherited executable DOM attributes

highgithub_advisoriesPublished 2026-09-02

GHSA-cp6q-959q-f8rh Severity: medium CVE: None

Tiptap: mergeAttributes() turns an own __proto__ key into inherited executable DOM attributes

## Summary

`@tiptap/core`'s public `mergeAttributes()` helper uses ordinary bracket assignment on keys returned by `Object.entries()`. An own `__proto__` key from JSON therefore invokes the legacy prototype setter on the fresh merged object. The function r

MITRE ATT&CK techniques

Indicators of compromise

Original source: https://github.com/advisories/GHSA-cp6q-959q-f8rh