[GHSA-cp6q-959q-f8rh] Tiptap: mergeAttributes() turns an own __proto__ key into inherited executable DOM attributes

[joshkel]

Updates

• Affected products

Comments
The fix was backported to the v2 line and released as 2.27.3:

• The 2.27.3 release isn't tagged on GitHub, but its SHA is available at https://www.npmjs.com/package/@tiptap/core/v/2.27.3
• The changes between 2.27.2 and 2.27.3 can therefore be viewed at https://github.com/ueberdosis/tiptap/compare/@tiptap/react@2.27.2...0ed4a30a6cda23799a01881f67d01ad218a2ac6d
• The specific commit that backports the fix is at ueberdosis/tiptap@fa6abcc

[github]

Hi there @bdbch! A community member has suggested an improvement to your security advisory. If approved, this change will affect the global advisory listed at github.com/advisories. It will not affect the version listed in your project repository.

This change will be reviewed by our Security Curation Team. If you have thoughts or feedback, please share them in a comment here! If this PR has already been closed, you can start a new community contribution for this advisory

[Copilot]

🔵 Needs a closer look

The correctness of the security-sensitive affected-version boundaries (2.27.3 backport and 3.0.0-next.0 start tag) depends on external package facts that require maintainer verification.

Pull request overview

This PR updates the GitHub-reviewed security advisory GHSA-cp6q-959q-f8rh (a per-object prototype manipulation issue in Tiptap's mergeAttributes()). Previously the advisory declared a single affected range for @tiptap/core (2.0.0-alpha.0 → fixed 3.30.4), which incorrectly implied that the backported v2 fix line was still vulnerable. The PR splits the affected data into two release lines to reflect that the fix was also backported to v2 and released as 2.27.3.

Changes:

• Split the v3 range so it is scoped to introduced 3.0.0-next.0 → fixed 3.30.4.
• Add a second affected entry for @tiptap/core covering the v2 line: introduced 2.0.0-alpha.0 → fixed 2.27.3.
• Bump the modified timestamp by one second.

File summaries

File	Description
advisories/github-reviewed/2026/09/GHSA-cp6q-959q-f8rh/GHSA-cp6q-959q-f8rh.json	Splits the affected versions into distinct v2 and v3 release-line ranges and bumps modified.

Notes from review:

• JSON is valid; modified (14:44:40Z) is ≥ published (14:44:39Z).
• Using two separate affected entries for the same package to represent different fixed release lines is consistent with established repo convention (e.g. GHSA-v56q-mh7h-f735.json).
• The two ranges do not overlap and leave no vulnerable gap between 2.27.3 and 3.0.0-next.0.
• The narrative details field still states "No fixed release was found," which is now inconsistent with the listed fixed versions, but that text is outside the changed lines so no inline comment is applicable.
• I could not independently verify (no network) that 2.27.3 and 3.0.0-next.0 are the exact correct boundary tags; the PR description provides supporting npm/commit references.

No blocking code issues were found in the diff.

Review details

• Files reviewed: 1/1 changed files
• Comments generated: 0
• Review effort level: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[G-Rath]

This is a duplicate of #9375