[GHSA-cp6q-959q-f8rh] Tiptap: mergeAttributes() turns an own __proto__ key into inherited executable DOM attributes - #9393
Conversation
|
Hi there @bdbch! A community member has suggested an improvement to your security advisory. If approved, this change will affect the global advisory listed at github.com/advisories. It will not affect the version listed in your project repository. This change will be reviewed by our Security Curation Team. If you have thoughts or feedback, please share them in a comment here! If this PR has already been closed, you can start a new community contribution for this advisory |
There was a problem hiding this comment.
🟡 Changes recommended
The new v3 range incorrectly excludes vulnerable 3.0.0 prereleases.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Pull request overview
Updates the Tiptap advisory to recognize the v2 backported security fix.
Changes:
- Marks
2.27.3and3.30.4as fixed versions. - Updates the affected-version description.
File summaries
| File | Description |
|---|---|
GHSA-cp6q-959q-f8rh.json |
Updates Tiptap affected ranges and remediation details. |
Review details
- Files reviewed: 1/1 changed files
- Comments generated: 1
- Review effort level: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| "type": "ECOSYSTEM", | ||
| "events": [ | ||
| { | ||
| "introduced": "3.0.0" |
There was a problem hiding this comment.
Good catch. I verified that 3.0.0-beta.0 already contains the vulnerable mergeAttributes implementation. Please change the v3 range’s introduced version from 3.0.0 to 3.0.0-beta.0.
I cannot do it myself. The GitHub UI won't let me:
Updates
Comments
Tiptap backported the mergeAttributes prototype-manipulation fix to the v2 release line in @tiptap/core 2.27.3. The current advisory only identifies 3.30.4 as patched, which causes Dependabot to continue reporting 2.27.3 as vulnerable.
The 2.27.3 changelog explicitly documents this fix:
https://github.com/ueberdosis/tiptap/blob/0ed4a30a6cda23799a01881f67d01ad218a2ac6d/packages/core/CHANGELOG.md#2273