{"id":"GHSA-4595-7fjw-r3jh","aliases":["CVE-2026-47110"],"title":"Tiptap contains an input validation vulnerability resulting in DoS","titleSource":"OSV","descriptionSource":"OSV","declaredSeverity":"HIGH","description":"Tiptap for PHP before version 2.1.1 contains an input validation vulnerability that allows authenticated attackers to cause a denial of service by submitting Tiptap JSON with the attrs.href field set to an array instead of a string, causing an unhandled TypeError in the Link::isAllowedUri() function when passed to preg_match(). Attackers can persist malformed JSON records that permanently crash the server-side HTML rendering pipeline for all subsequent viewers of that record until the database entry is manually repaired.","severity":"medium","score":6.5,"published":"2026-06-25T00:33:22.000Z","modified":"2026-10-07T14:16:45.716Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"ueberdosis/tiptap-php","sources":[{"name":"OSV · GHSA-4595-7fjw-r3jh","url":"https://osv.dev/vulnerability/GHSA-4595-7fjw-r3jh"}],"ranges":[{"events":[{"introduced":"0"},{"fixed":"2.1.1"}],"type":"ECOSYSTEM"}],"versions":["1.0.0","1.1.0","1.2.0","1.3.0","1.4.0","2.0.0","2.1.0"],"fixed":["2.1.1"]}],"sourceAffected":[],"references":["https://nvd.nist.gov/vuln/detail/CVE-2026-47110","https://github.com/ueberdosis/tiptap-php/pull/94","https://github.com/ueberdosis/tiptap-php/commit/74bfb7be1c8c6102b240f3879b7f984a6ab87b97","https://github.com/ueberdosis/tiptap-php","https://github.com/ueberdosis/tiptap-php/releases/tag/2.1.1","https://www.vulncheck.com/advisories/tiptap-for-php-dos-via-malformed-href-attribute"],"sources":[{"name":"OSV","id":"GHSA-4595-7fjw-r3jh","modified":"2026-10-07T14:16:45.716820967Z","url":"https://osv.dev/vulnerability/GHSA-4595-7fjw-r3jh"}],"assessments":[{"source":"OSV","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","score":6.5},{"source":"OSV","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","score":7.1}],"products":[],"remediation":[],"kev":{"status":"not-listed","checkedAt":"2026-10-28T20:25:31.474Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[]}