Executive brief
Tiptap is a popular rich-text editor component used in web applications. A flaw in its mergeAttributes() function allows an attacker to inject malicious code into objects that get rendered as DOM elements, resulting in arbitrary JavaScript execution within the application's security context. Applications that process untrusted input (from imports, plugins, or APIs) and use dynamic schemas are at risk.
Technical details
The vulnerability is a prototype pollution issue in @tiptap/core's mergeAttributes() helper function. When merging object properties using Object.entries() and bracket assignment, the code fails to filter the __proto__ key, which invokes JavaScript's legacy prototype setter. This creates an object with an attacker-controlled prototype, but hides the malicious properties from Object.keys() checks. When the result is consumed by prosemirror-model's DOMSerializer, its for...in enumeration picks up inherited properties and applies them as DOM attributes via setAttribute(), allowing event handlers like onerror to execute. The attack requires untrusted input flowing into mergeAttributes(), such as imported JSON documents, custom schemas, or API responses. A fixed version 3.30.4 is available; all versions from 2.0.0-alpha.0 through 3.29.2 are vulnerable.
Affected products
- ueberdosis Tiptap >=2.0.0-alpha.0 through 3.29.2; fixed in 3.30.4
Timeline
- 2026-09-02: disclosed: Vulnerability advisory published
- 2026-09-02: patched: Fixed version 3.30.4 released