Description
Tiptap for PHP before version 2.1.1 contains an input validation vulnerability that allows authenticated attackers to cause a denial of service by submitting Tiptap JSON with the attrs.href field set to an array instead of a string, causing an unhandled TypeError in the Link::isAllowedUri() function when passed to preg_match(). Attackers can persist malformed JSON records that permanently crash the server-side HTML rendering pipeline for all subsequent viewers of that record until the database entry is manually repaired.
Severity (CVSS)
| Base score | 7.1 |
|---|---|
| Severity | High |
| Version | CVSS 4.0 |
| Vector | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
| Provided by | CNA |
Weaknesses
- CWE-241 — Improper Handling of Unexpected Data Type
Affected products
| Vendor | Product | Versions |
|---|---|---|
| ueberdosis | tiptap-php | 0 to <2.1.1 |
References
- https://github.com/ueberdosis/tiptap-php/releases/tag/2.1.1 (release-notes)
- https://github.com/ueberdosis/tiptap-php/pull/94 (issue-tracking)
- https://github.com/ueberdosis/tiptap-php/commit/74bfb7be1c8c6102b240f3879b7f984a6ab87b97 (patch)
- https://www.vulncheck.com/advisories/tiptap-for-php-dos-via-malformed-href-attribute (third-party-advisory)
Generated from the official CVE List on 25 Jun 2026 10:14 UTC.