THREATOPS
THREAT OPSThreat News › [GHSA] GHSA-j95f-988m-3j2f (high) — Tiptap: Quadratic ReDoS in block and inline Markdown attribute parsing

[GHSA] GHSA-j95f-988m-3j2f (high) — Tiptap: Quadratic ReDoS in block and inline Markdown attribute parsing

highgithub_advisoriesPublished 2026-09-08

GHSA-j95f-988m-3j2f Severity: high CVE: None

Tiptap: Quadratic ReDoS in block and inline Markdown attribute parsing

## Summary

`@tiptap/core` contains two quadratic regular-expression denial-of-service paths in its default Markdown attribute parsers. Pandoc-style block attributes use two unanchored greedy expressions that rescan repeated `__QUOTED_0` prefixes. Inline shortcode attributes use an

Indicators of compromise

Original source: https://github.com/advisories/GHSA-j95f-988m-3j2f