PT-2026-90708

Summary @tiptap/core's public mergeAttributes helper uses ordinary bracket assignment on keys returned by Object.entries. An own proto key from JSON therefore invokes the legacy prototype setter on the fresh merged object. The function returns an object whose prototype is attacker-controlled, whi...

Cross-site Scripting (XSS)

Overview prosemirror-model is a ProseMirror's document model Affected versions of this package are vulnerable to Cross-site Scripting XSS due to serializeNodeInner and serializeMark functions that put a value from an attribute directly in an array used to describe a DOM structure and not fully...

@a-type/ui (>=0.8.17, <=1.2.3), @adminjs/design-system (>=3.0.0-beta.4, <=3.1.1) +427 more potentially affected by unknown CVE via prosemirror-model (>=1.0.1, <=1.21.3)

prosemirror-model NPM version =1.0.1, =0.8.17, =3.0.0-beta.4, =0.1.0, =0.0.1, =13.1.0, =10.4.0, =0.0.2, =3.0.0, =16.0.0, =0.0.1, =3.1.7, =11.0.6, =4.0.13, =73.4.4, =194.4.0 and more Source cves: unknown CVE Source advisory: SNYK:JS-PROSEMIRRORMODEL-7838221...