Snyk Security Database

@tiptap/core is a headless rich text editor

Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) through the Pandoc-style parseAttributes helper in packages/core/src/utilities/markdown/attributeUtils.ts and the shortcode attribute parser in packages/core/src/utilities/markdown/createInlineMarkdownSpec.ts. An attacker can block the browser main thread, server event loop, or worker by supplying crafted Markdown attribute strings to createAtomBlockMarkdownSpec, createBlockMarkdownSpec, or createInlineMarkdownSpec. Persisted Markdown documents can repeatedly freeze clients, and repeated parsing requests can tie up server-side Markdown processing with a small input.

litellm is a Library to easily interface with LLM API providers

Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) through request-body validation in the proxy auth path. An authenticated user can supply routing or credential parameters such as api_base, base_url, or other deployment-owned fields in the request body to redirect an outbound provider call to an attacker-controlled destination and make the proxy send its configured upstream credentials there. The vulnerable validation missed sensitive parameters and did not consistently inspect nested request fields, so caller-controlled body data could override server-side deployment settings instead of being rejected. From the user’s perspective, this can leak provider API keys and other configured secrets and can also be used to make the proxy reach internal services that are otherwise only accessible from its network.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the tokensFromInput() method of TreePointer, which parses JSON Pointer segments with repeated substring() calls that copy the remaining string each iteration (O(n^2)) and accumulates the parsed tokens into an unbounded ArrayList. An attacker can consume CPU quadratically and exhaust the JVM heap by supplying a JSON Pointer with a very large number of segments, on the order of 200,000 or more. This requires the application to parse an attacker-controlled JSON Pointer, which reaches this library through JSON Patch operations, JSON Schema references, or API parameters via json-schema-validator and json-patch.