Tiptap: mergeAttributes() turns an own __proto__ key into inherited executable DOM attributes

Summary @tiptap/core's public mergeAttributes helper uses ordinary bracket assignment on keys returned by Object.entries. An own proto key from JSON therefore invokes the legacy prototype setter on the fresh merged object. The function returns an object whose prototype is attacker-controlled, whi...