StackRadar

GHSA-cp6q-959q-f8rh

Medium

Advisory

Published 2 Sept 2026In the index since 6 Sept 2026
Severity
Medium
worst across findings
CVSS
6.4
base score, highest
EPSS
—
probability of exploitation
CISA KEV
Not listed
no confirmed exploitation
Charts affected
20
of 17,781 indexed, latest versions
Container images
18
deployed by those charts
Fix available
1 of 1
affected package

Tiptap: mergeAttributes() turns an own __proto__ key into inherited executable DOM attributes

Carried by container images the latest versions of 20 of 17,781 indexed charts deploy, on 18 images.

Affected packageAffected versionsFixed inImages
@tiptap/corenpm2.0.0-beta.220, 2.0.4, 2.1.12, 2.1.13+6 more3.30.418
OSV records
GHSA-cp6q-959q-f8rh

Charts affected

20 by stars
ChartLatestAffected imagesRadar Score
n8ncommunity-chartsVerified publisher1.24.401 of 1See more

n8n community-charts 1.24.40

1 of the 1 container images this version deploys carry GHSA-cp6q-959q-f8rh.

Container imageDigestPackageFixed in
n8nio/n8n:2.38.45d9f0cc5672b
@tiptap/core@3.27.0
3.30.4

Open the chart page →

772
n8nopen-8gears2.1.11 of 1See more

n8n open-8gears 2.1.1

1 of the 1 container images this version deploys carry GHSA-cp6q-959q-f8rh.

Container imageDigestPackageFixed in
n8nio/n8n:2.36.8cfe2704ff858
@tiptap/core@3.27.0
3.30.4

Open the chart page →

1,038
openprojectopenproject-helm-chartsOfficialVerified publisher13.11.01 of 5See more

openproject openproject-helm-charts 13.11.0

1 of the 5 container images this version deploys carry GHSA-cp6q-959q-f8rh.

Container imageDigestPackageFixed in
openproject/hocuspocus:release-338001b288dc1359dfb5
@tiptap/core@3.13.0
3.30.4

Open the chart page →

19,926
n8nhelmforgeVerified publisher2.0.01 of 2See more

n8n helmforge 2.0.0

1 of the 2 container images this version deploys carry GHSA-cp6q-959q-f8rh.

Container imageDigestPackageFixed in
n8nio/n8n:2.38.45d9f0cc5672b
@tiptap/core@3.27.0
3.30.4

Open the chart page →

863
homarroben01Verified publisher1.4.01 of 1See more

homarr oben01 1.4.0

1 of the 1 container images this version deploys carry GHSA-cp6q-959q-f8rh.

Container imageDigestPackageFixed in
ghcr.io/ajnart/homarr:0.16.0737ec361ed24
@tiptap/core@2.1.12
3.30.4

Open the chart page →

2,581
docmosthelmforgeVerified publisher1.2.111 of 4See more

docmost helmforge 1.2.11

1 of the 4 container images this version deploys carry GHSA-cp6q-959q-f8rh.

Container imageDigestPackageFixed in
docmost/docmost:0.95.041c8d777cf23
@tiptap/core@3.27.1
3.30.4

Open the chart page →

5,564
baserowbaserow-chartVerified publisher1.0.561 of 6See more

baserow baserow-chart 1.0.56

1 of the 6 container images this version deploys carry GHSA-cp6q-959q-f8rh.

Container imageDigestPackageFixed in
baserow/web-frontend:2.3.3566d24c7d9f5
@tiptap/core@3.15.3
3.30.4

Open the chart page →

17,263
convertigoconvertigoOfficialVerified publisher8.4.31 of 5See more

convertigo convertigo 8.4.3

1 of the 5 container images this version deploys carry GHSA-cp6q-959q-f8rh.

Container imageDigestPackageFixed in
baserow/baserow:1.30.1df0c42eb67e8
@tiptap/core@2.1.13
3.30.4

Open the chart page →

17,404
cosmocosmo-platformOfficialVerified publisher0.20.01 of 10See more

cosmo cosmo-platform 0.20.0

1 of the 10 container images this version deploys carry GHSA-cp6q-959q-f8rh.

Container imageDigestPackageFixed in
ghcr.io/wundergraph/cosmo/controlplane:0.133.149800ff775f3
@tiptap/core@2.1.13
3.30.4

Open the chart page →

28,839
growthbookgrowthbook5.0.11 of 2See more

growthbook growthbook 5.0.1

1 of the 2 container images this version deploys carry GHSA-cp6q-959q-f8rh.

Container imageDigestPackageFixed in
growthbook/growthbook:5.0.1f53ead646b5f
@tiptap/core@3.30.0
3.30.4

Open the chart page →

709
homarrdelerVerified publisher1.0.11 of 1See more

homarr deler 1.0.1

1 of the 1 container images this version deploys carry GHSA-cp6q-959q-f8rh.

Container imageDigestPackageFixed in
ghcr.io/ajnart/homarr:0.13.4985456bdfb46
@tiptap/core@2.0.4
3.30.4

Open the chart page →

1,924
n8nn8n-openshiftVerified publisher1.18.01 of 1See more

n8n n8n-openshift 1.18.0

1 of the 1 container images this version deploys carry GHSA-cp6q-959q-f8rh.

Container imageDigestPackageFixed in
n8nio/n8n:2.36.714c4285bc303
@tiptap/core@3.27.0
3.30.4

Open the chart page →

1,038
n8nopenshift1.18.01 of 1See more

n8n openshift 1.18.0

1 of the 1 container images this version deploys carry GHSA-cp6q-959q-f8rh.

Container imageDigestPackageFixed in
n8nio/n8n:2.36.714c4285bc303
@tiptap/core@3.27.0
3.30.4

Open the chart page →

1,038
speckle-server-branch-hotfix-2.19.1speckleVerified publisher2.19.2-branch.hotfix-2.19.1.124125-665e7e11 of 5See more

speckle-server-branch-hotfix-2.19.1 speckle 2.19.2-branch.hotfix-2.19.1.124125-665e7e1

1 of the 5 container images this version deploys carry GHSA-cp6q-959q-f8rh.

Container imageDigestPackageFixed in
speckle/speckle-frontend-2:2.19.2-branch.hotfix-2.19.1.124125-665e7e14f9241665ae3
@tiptap/core@2.0.0-beta.220
3.30.4

Open the chart page →

16,368
speckle-server-branch-hotfix-2.20.2speckleVerified publisher2.20.3-branch.hotfix-2.20.2.149555-37ea0cb1 of 5See more

speckle-server-branch-hotfix-2.20.2 speckle 2.20.3-branch.hotfix-2.20.2.149555-37ea0cb

1 of the 5 container images this version deploys carry GHSA-cp6q-959q-f8rh.

Container imageDigestPackageFixed in
speckle/speckle-frontend-2:2.20.3-branch.hotfix-2.20.2.149555-37ea0cbfdc008effc7a
@tiptap/core@2.0.0-beta.220
3.30.4

Open the chart page →

16,400
speckle-server-branch-testing1speckleVerified publisher2.20.6-branch.testing1.154030-9b091141 of 5See more

speckle-server-branch-testing1 speckle 2.20.6-branch.testing1.154030-9b09114

1 of the 5 container images this version deploys carry GHSA-cp6q-959q-f8rh.

Container imageDigestPackageFixed in
speckle/speckle-frontend-2:2.20.6-branch.testing1.154030-9b0911432fc940d9b4c
@tiptap/core@2.0.0-beta.220
3.30.4

Open the chart page →

16,400
speckle-server-branch-testing4speckleVerified publisher2.20.2-branch.testing4.134160-9fad4b21 of 5See more

speckle-server-branch-testing4 speckle 2.20.2-branch.testing4.134160-9fad4b2

1 of the 5 container images this version deploys carry GHSA-cp6q-959q-f8rh.

Container imageDigestPackageFixed in
speckle/speckle-frontend-2:2.20.2-branch.testing4.134160-9fad4b210ad4ade8bf2
@tiptap/core@2.0.0-beta.220
3.30.4

Open the chart page →

16,019
speckle-server-branch-testing5speckleVerified publisher2.21.3-branch.testing5.219631-2153bef1 of 5See more

speckle-server-branch-testing5 speckle 2.21.3-branch.testing5.219631-2153bef

1 of the 5 container images this version deploys carry GHSA-cp6q-959q-f8rh.

Container imageDigestPackageFixed in
speckle/speckle-frontend-2:2.21.3-branch.testing5.219631-2153befd4ca6ebf09b9
@tiptap/core@2.0.0-beta.220
3.30.4

Open the chart page →

15,635
twentytwenty-crm0.1.111 of 4See more

twenty twenty-crm 0.1.11

1 of the 4 container images this version deploys carry GHSA-cp6q-959q-f8rh.

Container imageDigestPackageFixed in
twentycrm/twenty:v2.22.0e7d9948bf284
@tiptap/core@3.20.0
3.30.4

Open the chart page →

5,550
homarrvhdirkVerified publisher0.1.51 of 1See more

homarr vhdirk 0.1.5

1 of the 1 container images this version deploys carry GHSA-cp6q-959q-f8rh.

Container imageDigestPackageFixed in
ghcr.io/ajnart/homarr:lateste103abadfb52
@tiptap/core@2.1.12
3.30.4

Open the chart page →

2,789

Container images carrying it

18 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
n8nio/n8n:2.36.714c4285bc303
@tiptap/core@3.27.0
3.30.4
2
n8nio/n8n:2.38.45d9f0cc5672b
@tiptap/core@3.27.0
3.30.4
2
baserow/baserow:1.30.1df0c42eb67e8
@tiptap/core@2.1.13
3.30.4
1
baserow/web-frontend:2.3.3566d24c7d9f5
@tiptap/core@3.15.3
3.30.4
1
docmost/docmost:0.95.041c8d777cf23
@tiptap/core@3.27.1
3.30.4
1
growthbook/growthbook:5.0.1f53ead646b5f
@tiptap/core@3.30.0
3.30.4
1
n8nio/n8n:2.36.8cfe2704ff858
@tiptap/core@3.27.0
3.30.4
1
openproject/hocuspocus:release-338001b288dc1359dfb5
@tiptap/core@3.13.0
3.30.4
1
speckle/speckle-frontend-2:2.20.2-branch.testing4.134160-9fad4b210ad4ade8bf2
@tiptap/core@2.0.0-beta.220
3.30.4
1
speckle/speckle-frontend-2:2.20.6-branch.testing1.154030-9b0911432fc940d9b4c
@tiptap/core@2.0.0-beta.220
3.30.4
1
speckle/speckle-frontend-2:2.19.2-branch.hotfix-2.19.1.124125-665e7e14f9241665ae3
@tiptap/core@2.0.0-beta.220
3.30.4
1
speckle/speckle-frontend-2:2.21.3-branch.testing5.219631-2153befd4ca6ebf09b9
@tiptap/core@2.0.0-beta.220
3.30.4
1
speckle/speckle-frontend-2:2.20.3-branch.hotfix-2.20.2.149555-37ea0cbfdc008effc7a
@tiptap/core@2.0.0-beta.220
3.30.4
1
twentycrm/twenty:v2.22.0e7d9948bf284
@tiptap/core@3.20.0
3.30.4
1
ghcr.io/ajnart/homarr:0.16.0737ec361ed24
@tiptap/core@2.1.12
3.30.4
1
ghcr.io/ajnart/homarr:0.13.4985456bdfb46
@tiptap/core@2.0.4
3.30.4
1
ghcr.io/ajnart/homarr:lateste103abadfb52
@tiptap/core@2.1.12
3.30.4
1
ghcr.io/wundergraph/cosmo/controlplane:0.133.149800ff775f3
@tiptap/core@2.1.13
3.30.4
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.