Executive brief
Tiptap is a popular rich-text editor framework used in many web applications. The library's Markdown parser contains two uncontrolled regular-expression processing flaws that allow attackers to send specially crafted Markdown content that causes the browser or server to freeze for several seconds, disrupting service availability. An attacker can exploit this by embedding malicious Markdown in documents or sending it to a server-side parser, potentially blocking all processing on that system.
Technical details
The vulnerability consists of two separate ReDoS flaws in Markdown parsing helpers. The block-attribute parser in `attributeUtils.ts` uses an unanchored regex `/([a-zA-Z][\w-]*)\s*=\s*(__QUOTED_\d+__)/g` that rescans repeated placeholder strings (e.g., `__QUOTED_0` repeated thousands of times); at each position the greedy key-name expression fails to match the equals sign and the engine restarts, yielding O(n²) complexity. The inline-attribute parser in `createInlineMarkdownSpec.ts` uses `/(\w+)=(?:"([^"]*)"|'([^']*)')/g` which similarly rescans long word-character runs without equals signs. Both parsing paths are exposed through public APIs (`createAtomBlockMarkdownSpec`, `createBlockMarkdownSpec`, `createInlineMarkdownSpec`). An unauthenticated attacker can deliver malicious Markdown—either through document persistence or direct server-side parsing—to freeze the browser main thread, event loop, or worker processes. The vulnerability was introduced in October 2025 and remains unpatched in versions 3.7.0 through 3.29.2. Version 3.30.5 contains fixes.
Affected products
- ueberdosis @tiptap/core >=3.7.0, <3.30.5
Timeline
- 2026-09-08: disclosed: GitHub Advisory published
- 2026-09-08: patched: Version 3.30.5 released with fix