GHSA-cp6q-959q-f8rh: Tiptap: mergeAttributes() turns an own __proto__ key into inherited executable DOM attributes

@tiptap/core’s public mergeAttributes() helper uses ordinary bracket assignment on keys returned by Object.entries(). An own __proto__ key from JSON therefore invokes the legacy prototype setter on the fresh merged object. The function returns an object whose prototype is attacker-controlled, while Object.keys() and ordinary own-property checks show no attacker attributes.

When that result is used as a ProseMirror DOMOutputSpec attribute object, prosemirror-model’s DOMSerializer.renderSpec() enumerates it with for...in and applies inherited values with setAttribute(). In a browser proof, inherited src and onerror values were copied to an <img> and the error handler executed once. This is per-object prototype manipulation; the proof does not modify global Object.prototype.