PT-2026-95732

Summary @tiptap/core contains two quadratic regular-expression denial-of-service paths in its default Markdown attribute parsers. Pandoc-style block attributes use two unanchored greedy expressions that rescan repeated QUOTED 0 prefixes. Inline shortcode attributes use another unanchored greedy k...