@tiptap/core vulnerabilities
CVEs whose affected-version data names the @tiptap/core package (npm). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
GHSA-j95f-988m-3j2fHighTiptap: Quadratic ReDoS in block and inline Markdown attribute parsing
Tiptap: Quadratic ReDoS in block and inline Markdown attribute parsing
▾ Twilighttiptap · @tiptap/corevia GHSA
GHSA-cp6q-959q-f8rhMediumTiptap: mergeAttributes() turns an own __proto__ key into inherited executable DOM attributes
Tiptap: mergeAttributes() turns an own __proto__ key into inherited executable DOM attributes
▾ Sunlittiptap · @tiptap/corevia GHSA