CVE-2026-104979 Plane: Cross-tenant stored XSS in intake enables account takeover

Plane is an open-source project management tool. Prior to 1.4.0, IntakeIssuePublicViewSet.create in Plane v1.3.1 writes descriptionhtml through Issue.objects.create... without calling validatehtmlcontent from nh3. Any authenticated user, including a new user with no workspace memberships, can pla...

CVE-2026-104979 Plane: Cross-tenant stored XSS in intake enables account takeover

Plane is an open-source project management tool. Prior to 1.4.0, IntakeIssuePublicViewSet.create in Plane v1.3.1 writes descriptionhtml through Issue.objects.create... without calling validatehtmlcontent from nh3. Any authenticated user, including a new user with no workspace memberships, can pla...

CVE-2026-104979 Plane: Cross-tenant stored XSS in intake enables account takeover

Plane is an open-source project management tool. Prior to 1.4.0, IntakeIssuePublicViewSet.create in Plane v1.3.1 writes descriptionhtml through Issue.objects.create... without calling validatehtmlcontent from nh3. Any authenticated user, including a new user with no workspace memberships, can pla...

CVE-2026-104979

The open-source project management tool Plane is vulnerable to a cross-tenant stored XSS in versions prior to 1.4.0 . The root cause is that IntakeIssuePublicViewSet.create in Plane v1.3.1 writes description_html via Issue.objects.create(...) without invoking validate_html_content from nh3 . This...

ROOT-APP-NPM-GHSA-J95F-988M-3J2F GHSA-j95f-988m-3j2f in @tiptap/core - Patched by Root

Root has patched GHSA-j95f-988m-3j2f in the @tiptap/core package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-AIKIDO-2026-613639 AIKIDO-2026-613639 in @tiptap/core - Patched by Root

Root has patched AIKIDO-2026-613639 in the @tiptap/core package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-AIKIDO-2026-65180 AIKIDO-2026-65180 in @tiptap/core - Patched by Root

Root has patched AIKIDO-2026-65180 in the @tiptap/core package for Root:npm. Multiple fixed versions available...

PT-2026-99418

Root has patched AIKIDO-2026-613639 in the @tiptap/core package for Root:npm. Multiple fixed versions available...

PT-2026-99419

Root has patched AIKIDO-2026-65180 in the @tiptap/core package for Root:npm. Multiple fixed versions available...

@a3s-lab/office (>=0.1.0, <=0.312.0), @acms-subir/core (>=0.3.4, <=0.3.31) +308 more potentially affected by unknown CVE via @tiptap/core (>=3.7.0, <=3.30.4)

@tiptap/core NPM version =3.7.0, =0.1.0, =0.3.4, =0.2.0, =0.2.0-nightly-20260914153919, =0.0.0-beta-20260819155526, =0.0.0-beta-20260819155526, =0.1.26, =0.0.0-beta-20260819155526, =0.0.0-beta-20260819143124, =1.0.0, =0.2.0, =2.2.2, =2.3.0, =1.3.7-beta.22, =3.0.0-beta.4 and more Source cves:...

Regular Expression Denial of Service (ReDoS)

Overview @tiptap/core is a headless rich text editor Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS through the Pandoc-style parseAttributes helper in packages/core/src/utilities/markdown/attributeUtils.ts and the shortcode attribute parser in...

@a3s-lab/office (>=0.1.0, <=0.312.0), @acms-subir/core (>=0.3.4, <=0.3.31) +308 more potentially affected by unknown CVE via @tiptap/core (>=3.7.0, <=3.30.4)

@tiptap/core NPM version =3.7.0, =0.1.0, =0.3.4, =0.2.0, =0.2.0-nightly-20260914153919, =0.0.0-beta-20260819155526, =0.0.0-beta-20260819155526, =0.1.26, =0.0.0-beta-20260819155526, =0.0.0-beta-20260819143124, =1.0.0, =0.2.0, =2.2.2, =2.3.0, =1.3.7-beta.22, =3.0.0-beta.4 and more Source cves:...

Tiptap: Quadratic ReDoS in block and inline Markdown attribute parsing

Summary @tiptap/core contains two quadratic regular-expression denial-of-service paths in its default Markdown attribute parsers. Pandoc-style block attributes use two unanchored greedy expressions that rescan repeated QUOTED0 prefixes. Inline shortcode attributes use another unanchored greedy ke...

@a3s-lab/office (>=0.1.0, <=0.312.0), @acms-subir/core (>=0.3.4, <=0.3.31) +308 more potentially affected by unknown CVE via @tiptap/core (>=3.7.0, <=3.30.4)

@tiptap/core NPM version =3.7.0, =0.1.0, =0.3.4, =0.2.0, =0.2.0-nightly-20260914153919, =0.0.0-beta-20260819155526, =0.0.0-beta-20260819155526, =0.1.26, =0.0.0-beta-20260819155526, =0.0.0-beta-20260819143124, =1.0.0, =0.2.0, =2.2.2, =2.3.0, =1.3.7-beta.22, =3.0.0-beta.4 and more Source cves:...

GHSA-J95F-988M-3J2F Tiptap: Quadratic ReDoS in block and inline Markdown attribute parsing

Summary @tiptap/core contains two quadratic regular-expression denial-of-service paths in its default Markdown attribute parsers. Pandoc-style block attributes use two unanchored greedy expressions that rescan repeated QUOTED0 prefixes. Inline shortcode attributes use another unanchored greedy ke...

PT-2026-95732

Summary @tiptap/core contains two quadratic regular-expression denial-of-service paths in its default Markdown attribute parsers. Pandoc-style block attributes use two unanchored greedy expressions that rescan repeated QUOTED 0 prefixes. Inline shortcode attributes use another unanchored greedy k...

Tiptap: mergeAttributes() turns an own __proto__ key into inherited executable DOM attributes

Summary @tiptap/core's public mergeAttributes helper uses ordinary bracket assignment on keys returned by Object.entries. An own proto key from JSON therefore invokes the legacy prototype setter on the fresh merged object. The function returns an object whose prototype is attacker-controlled, whi...

7pmlabs-design-system (>=0.5.0, <=0.5.15), @10planet/deva-sdk (>=0.7.0, <=0.7.2) +2916 more potentially affected by unknown CVE via @tiptap/core (>=2.0.0-beta.54, <=3.30.3)

@tiptap/core NPM version =2.0.0-beta.54, =0.5.0, =0.7.0, =0.1.2, =0.2.0, =1.0.0, =1.2.1, =0.1.0, =2.2.0-rc.7, =1.0.0, =1.0.0, =1.0.0, =2.12.2, =3.0.3, =4.0.5 - @.aayush./novelsh 0.1.0 and more Source cves: unknown CVE Source advisory: OSV:GHSA-CP6Q-959Q-F8RH...

7pmlabs-design-system (>=0.5.0, <=0.5.15), @10planet/deva-sdk (>=0.7.0, <=0.7.2) +2916 more potentially affected by unknown CVE via @tiptap/core (>=2.0.0-beta.54, <=3.30.3)

@tiptap/core NPM version =2.0.0-beta.54, =0.5.0, =0.7.0, =0.1.2, =0.2.0, =1.0.0, =1.2.1, =0.1.0, =2.2.0-rc.7, =1.0.0, =1.0.0, =1.0.0, =2.12.2, =3.0.3, =4.0.5 - @.aayush./novelsh 0.1.0 and more Source cves: unknown CVE Source advisory: SNYK:JS-TIPTAPCORE-19643571...

GHSA-CP6Q-959Q-F8RH Tiptap: mergeAttributes() turns an own __proto__ key into inherited executable DOM attributes

Summary @tiptap/core's public mergeAttributes helper uses ordinary bracket assignment on keys returned by Object.entries. An own proto key from JSON therefore invokes the legacy prototype setter on the fresh merged object. The function returns an object whose prototype is attacker-controlled, whi...