GHSA-CP6Q-959Q-F8RH
Vulnerability from github – Published: 2026-09-02 14:44 – Updated: 2026-09-02 14:44Summary
@tiptap/core's public mergeAttributes() helper uses ordinary bracket assignment on keys returned by Object.entries(). An own __proto__ key from JSON therefore invokes the legacy prototype setter on the fresh merged object. The function returns an object whose prototype is attacker-controlled, while Object.keys() and ordinary own-property checks show no attacker attributes.
When that result is used as a ProseMirror DOMOutputSpec attribute object, prosemirror-model's DOMSerializer.renderSpec() enumerates it with for...in and applies inherited values with setAttribute(). In a browser proof, inherited src and onerror values were copied to an <img> and the error handler executed once. This is per-object prototype manipulation; the proof does not modify global Object.prototype.
Root cause
The affected loop is conceptually:
const mergedAttributes = { ...items }
for (const [key, value] of Object.entries(item)) {
const exists = mergedAttributes[key]
// ...
mergedAttributes[key] = value
}
Object.entries(JSON.parse('{"__proto__": {...}}')) includes __proto__. Reading mergedAttributes['__proto__'] resolves the inherited Object.prototype; assigning to the same key invokes Object.prototype.__proto__'s setter and replaces mergedAttributes' prototype.
Browser reproduction
The following shape was tested with exact @tiptap/core 3.29.2 and prosemirror-model 1.25.11:
const input = JSON.parse(`{
"__proto__": {
"data-inherited-canary": "present",
"src": "x-invalid://canary",
"onerror": "globalThis.__tiptapXss += 1"
}
}`)
const attrs = mergeAttributes(input)
// Object.keys(attrs) === []
// Object.getPrototypeOf(attrs) === input.__proto__
const schema = new Schema({
nodes: {
doc: { content: 'image' },
image: { toDOM: () => ['img', attrs] },
text: {},
},
})
const doc = schema.node('doc', null, [schema.node('image')])
const fragment = DOMSerializer.fromSchema(schema).serializeFragment(doc.content)
document.body.append(fragment)
Chromium produced an image with data-inherited-canary, src, and onerror; the handler executed exactly once. Object.prototype remained clean.
Impact and preconditions
Applications that merge untrusted imported document, plugin, CMS, API, tenant, or AI-derived attribute objects can receive a prototype-manipulated result. Consumers that enumerate inherited keys, including ProseMirror's DOM serializer, can turn the hidden properties into DOM attributes and execute JavaScript in the application's origin. Own-key validation, object spread, JSON serialization, and logging can miss the inherited values. Other component consumers can read inherited authorization or configuration fields.
Tiptap's standard fixed ProseMirror schemas discard unknown document attributes, so arbitrary Tiptap JSON is not automatically exploitable in every application. A vulnerable application needs an untrusted object boundary into mergeAttributes() or a dynamic/custom extension or schema that preserves the relevant attribute object.
Affected versions
The unsafe assignment was introduced in commit ecadf7ea0a7f8f39a8496a60edf0ac8f379e6eb3 and is present in the first package tag @tiptap/core@2.0.0-alpha.0, v2.0.0, v2.27.1, v3.0.0, and current v3.29.2 source. No fixed release was found.
Recommended remediation
Reject __proto__ before reading or assigning the key, or define copied keys as own data properties without invoking legacy setters. A minimal hardening is to skip key === '__proto__'. Add regression tests using an own JSON-origin __proto__ key and assert that the result keeps Object.prototype as its prototype, exposes no inherited attacker keys, and cannot create an event-handler attribute through DOMSerializer.
This was found during authorized dependency review and is being reported privately. No public zero-day issue has been opened.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "@tiptap/core"
},
"ranges": [
{
"events": [
{
"introduced": "2.0.0-alpha.0"
},
{
"fixed": "3.30.4"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-1321",
"CWE-79"
],
"github_reviewed": true,
"github_reviewed_at": "2026-09-02T14:44:39Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "## Summary\n\n`@tiptap/core`\u0027s public `mergeAttributes()` helper uses ordinary bracket assignment on keys returned by `Object.entries()`. An own `__proto__` key from JSON therefore invokes the legacy prototype setter on the fresh merged object. The function returns an object whose prototype is attacker-controlled, while `Object.keys()` and ordinary own-property checks show no attacker attributes.\n\nWhen that result is used as a ProseMirror DOMOutputSpec attribute object, `prosemirror-model`\u0027s `DOMSerializer.renderSpec()` enumerates it with `for...in` and applies inherited values with `setAttribute()`. In a browser proof, inherited `src` and `onerror` values were copied to an `\u003cimg\u003e` and the error handler executed once. This is per-object prototype manipulation; the proof does not modify global `Object.prototype`.\n\n## Root cause\n\nThe affected loop is conceptually:\n\n```ts\nconst mergedAttributes = { ...items }\nfor (const [key, value] of Object.entries(item)) {\n const exists = mergedAttributes[key]\n // ...\n mergedAttributes[key] = value\n}\n```\n\n`Object.entries(JSON.parse(\u0027{\"__proto__\": {...}}\u0027))` includes `__proto__`. Reading `mergedAttributes[\u0027__proto__\u0027]` resolves the inherited `Object.prototype`; assigning to the same key invokes `Object.prototype.__proto__`\u0027s setter and replaces `mergedAttributes`\u0027 prototype.\n\n## Browser reproduction\n\nThe following shape was tested with exact `@tiptap/core` 3.29.2 and `prosemirror-model` 1.25.11:\n\n```js\nconst input = JSON.parse(`{\n \"__proto__\": {\n \"data-inherited-canary\": \"present\",\n \"src\": \"x-invalid://canary\",\n \"onerror\": \"globalThis.__tiptapXss += 1\"\n }\n}`)\n\nconst attrs = mergeAttributes(input)\n// Object.keys(attrs) === []\n// Object.getPrototypeOf(attrs) === input.__proto__\n\nconst schema = new Schema({\n nodes: {\n doc: { content: \u0027image\u0027 },\n image: { toDOM: () =\u003e [\u0027img\u0027, attrs] },\n text: {},\n },\n})\nconst doc = schema.node(\u0027doc\u0027, null, [schema.node(\u0027image\u0027)])\nconst fragment = DOMSerializer.fromSchema(schema).serializeFragment(doc.content)\ndocument.body.append(fragment)\n```\n\nChromium produced an image with `data-inherited-canary`, `src`, and `onerror`; the handler executed exactly once. `Object.prototype` remained clean.\n\n## Impact and preconditions\n\nApplications that merge untrusted imported document, plugin, CMS, API, tenant, or AI-derived attribute objects can receive a prototype-manipulated result. Consumers that enumerate inherited keys, including ProseMirror\u0027s DOM serializer, can turn the hidden properties into DOM attributes and execute JavaScript in the application\u0027s origin. Own-key validation, object spread, JSON serialization, and logging can miss the inherited values. Other component consumers can read inherited authorization or configuration fields.\n\nTiptap\u0027s standard fixed ProseMirror schemas discard unknown document attributes, so arbitrary Tiptap JSON is not automatically exploitable in every application. A vulnerable application needs an untrusted object boundary into `mergeAttributes()` or a dynamic/custom extension or schema that preserves the relevant attribute object.\n\n## Affected versions\n\nThe unsafe assignment was introduced in commit `ecadf7ea0a7f8f39a8496a60edf0ac8f379e6eb3` and is present in the first package tag `@tiptap/core@2.0.0-alpha.0`, v2.0.0, v2.27.1, v3.0.0, and current v3.29.2 source. No fixed release was found.\n\n## Recommended remediation\n\nReject `__proto__` before reading or assigning the key, or define copied keys as own data properties without invoking legacy setters. A minimal hardening is to skip `key === \u0027__proto__\u0027`. Add regression tests using an own JSON-origin `__proto__` key and assert that the result keeps `Object.prototype` as its prototype, exposes no inherited attacker keys, and cannot create an event-handler attribute through `DOMSerializer`.\n\nThis was found during authorized dependency review and is being reported privately. No public zero-day issue has been opened.",
"id": "GHSA-cp6q-959q-f8rh",
"modified": "2026-09-02T14:44:39Z",
"published": "2026-09-02T14:44:39Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/ueberdosis/tiptap/security/advisories/GHSA-cp6q-959q-f8rh"
},
{
"type": "WEB",
"url": "https://github.com/ueberdosis/tiptap/commit/01d7af8c983ee5954c63734f4fa46cb23ae3246d"
},
{
"type": "PACKAGE",
"url": "https://github.com/ueberdosis/tiptap"
},
{
"type": "WEB",
"url": "https://github.com/ueberdosis/tiptap/releases/tag/v3.30.4"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Tiptap: mergeAttributes() turns an own __proto__ key into inherited executable DOM attributes"
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.