@cloudcommerce/storefront (>=0.10.0, <=0.11.0), @gspenst/next (>=0.1.0, <=0.1.2) +6 more potentially affected by CVE-2026-108261 via @tinacms/app (>=2.0.0, <=2.5.12)

@tinacms/app NPM version =2.0.0, =0.10.0, =0.1.0, =0.1.0, =0.0.0-00a8b82-20260824011213, =0.0.2, =0.0.3, =0.1.1, =0.1.3 - ramidus 1.2.1 Source cves: CVE-2026-108261 Source advisory: GHSA-X34J-47HF-4XG7...

@cloudcommerce/storefront (>=0.10.0, <=0.11.0), @gspenst/next (>=0.1.0, <=0.1.2) +6 more potentially affected by CVE-2026-108261 via @tinacms/app (>=2.0.0, <=2.5.12)

@tinacms/app NPM version =2.0.0, =0.10.0, =0.1.0, =0.1.0, =0.0.0-00a8b82-20260824011213, =0.0.2, =0.0.3, =0.1.1, =0.1.3 - ramidus 1.2.1 Source cves: CVE-2026-108261 Source advisory: OSV:GHSA-X34J-47HF-4XG7...

@tinacms/app (>=0.0.0-574b548-20260304015858, <=2.5.9), @tinacms/cli (>=0.0.0-1c89c44-20260716070024, <=2.5.5) +1 more potentially affected by CVE-2026-108261 via tinacms (>=3.0.0, <=3.12.1)

tinacms NPM version =3.0.0, =0.0.0-574b548-20260304015858, =0.0.0-1c89c44-20260716070024, =0.0.0-f48009e-20260825053141, =0.2.18 Source cves: CVE-2026-108261 Source advisory: GHSA-X34J-47HF-4XG7...

@tinacms/app (>=0.0.0-574b548-20260304015858, <=2.5.9), @tinacms/cli (>=0.0.0-1c89c44-20260716070024, <=2.5.5) +1 more potentially affected by CVE-2026-108261 via tinacms (>=3.0.0, <=3.12.1)

tinacms NPM version =3.0.0, =0.0.0-574b548-20260304015858, =0.0.0-1c89c44-20260716070024, =0.0.0-f48009e-20260825053141, =0.2.18 Source cves: CVE-2026-108261 Source advisory: OSV:GHSA-X34J-47HF-4XG7...

@cloudcommerce/storefront (>=0.10.0, <=0.11.0), @gspenst/next (>=0.1.0, <=0.1.2) +6 more potentially affected by CVE-2026-108261 via @tinacms/app (>=0.0.0-a0a8cb3-20260817041004, <=2.5.12)

@tinacms/app NPM version =0.0.0-a0a8cb3-20260817041004, =0.10.0, =0.1.0, =0.1.0, =0.0.0-20220819182845, =0.0.2, =0.0.3, =0.1.1, =0.1.3 - ramidus 1.2.1 Source cves: CVE-2026-108261 Source advisory: MEND:CVE-2026-108261...

PT-2026-109316

Name of the Vulnerable Software and Affected Versions tinacms versions prior to 3.14.0 @tinacms/app versions prior to 2.5.14 Description An origin validation error in the admin preview route allows an unauthenticated attacker to perform a confused-deputy attack against the content API. By sending...

@cloudcommerce/storefront (>=0.10.0, <=0.11.0), @gspenst/next (>=0.1.0, <=0.1.2) +6 more potentially affected by CVE-2026-55660 via @tinacms/app (>=0.0.0-a0a8cb3-20260817041004, <=2.5.5)

@tinacms/app NPM version =0.0.0-a0a8cb3-20260817041004, =0.10.0, =0.1.0, =0.1.0, =0.0.0-20220819182845, =0.0.2, =0.0.3, =0.1.1, =0.1.3 - ramidus 1.2.1 Source cves: CVE-2026-55660 Source advisory: MEND:CVE-2026-55660...

@cloudcommerce/storefront (>=0.10.0, <=0.11.0), @gspenst/next (>=0.1.0, <=0.1.2) +6 more potentially affected by CVE-2026-55660 via @tinacms/app (>=2.0.0, <=2.5.5)

@tinacms/app NPM version =2.0.0, =0.10.0, =0.1.0, =0.1.0, =0.0.0-0120cc5-20241030181751, =0.0.2, =0.0.3, =0.1.1, =0.1.3 - ramidus 1.2.1 Source cves: CVE-2026-55660 Source advisory: OSV:GHSA-G5QX-H5F3-MP2F...

@cloudcommerce/storefront (>=0.10.0, <=0.11.0), @gspenst/next (>=0.1.0, <=0.1.2) +6 more potentially affected by CVE-2026-55660 via @tinacms/app (>=2.0.0, <=2.5.5)

@tinacms/app NPM version =2.0.0, =0.10.0, =0.1.0, =0.1.0, =0.0.0-0120cc5-20241030181751, =0.0.2, =0.0.3, =0.1.1, =0.1.3 - ramidus 1.2.1 Source cves: CVE-2026-55660 Source advisory: SNYK:JS-TINACMSAPP-17420389...

@cloudcommerce/storefront (>=0.10.0, <=0.11.0), @gspenst/next (>=0.1.0, <=0.1.2) +6 more potentially affected by CVE-2026-55660 via @tinacms/app (>=2.0.0, <=2.5.5)

@tinacms/app NPM version =2.0.0, =0.10.0, =0.1.0, =0.1.0, =0.0.0-0120cc5-20241030181751, =0.0.2, =0.0.3, =0.1.1, =0.1.3 - ramidus 1.2.1 Source cves: CVE-2026-55660 Source advisory: GHSA-G5QX-H5F3-MP2F...

@tinacms/app (>=0.0.0-574b548-20260304015858, <=2.5.5), @tinacms/cli (>=0.0.0-1d830a0-20260128234746, <=2.5.0) +1 more potentially affected by CVE-2026-55660 via tinacms (>=3.0.0, <=3.9.2)

tinacms NPM version =3.0.0, =0.0.0-574b548-20260304015858, =0.0.0-1d830a0-20260128234746, =0.1.12, =0.2.14 Source cves: CVE-2026-55660 Source advisory: GHSA-G5QX-H5F3-MP2F...

@tinacms/app (>=0.0.0-574b548-20260304015858, <=2.5.5), @tinacms/cli (>=0.0.0-1d830a0-20260128234746, <=2.5.0) +1 more potentially affected by CVE-2026-55660 via tinacms (>=3.0.0, <=3.9.2)

tinacms NPM version =3.0.0, =0.0.0-574b548-20260304015858, =0.0.0-1d830a0-20260128234746, =0.1.12, =0.2.14 Source cves: CVE-2026-55660 Source advisory: OSV:GHSA-G5QX-H5F3-MP2F...

Improper Verification of Source of a Communication Channel

Overview Affected versions of this package are vulnerable to Improper Verification of Source of a Communication Channel via improper validation of cross-origin messages in the window message listeners. An attacker can hijack authenticated editing sessions by sending crafted postMessage events fro...

@tinacms/app (>=0.0.0-574b548-20260304015858, <=2.5.5), @tinacms/cli (>=0.0.0-1d830a0-20260128234746, <=2.5.0) +1 more potentially affected by CVE-2026-55660 via tinacms (>=3.0.0, <=3.9.2)

tinacms NPM version =3.0.0, =0.0.0-574b548-20260304015858, =0.0.0-1d830a0-20260128234746, =0.1.12, =0.2.14 Source cves: CVE-2026-55660 Source advisory: SNYK:JS-TINACMS-17420390...

@tinacms/app (>=0.0.0-00aadfd-20260223215804, <=2.5.5), @tinacms/cli (>=0.0.0-00aadfd-20260223215804, <=2.5.0) +5 more potentially affected by CVE-2026-55661 via @tinacms/mdx (>=2.0.0, <=2.1.6)

@tinacms/mdx NPM version =2.0.0, =0.0.0-00aadfd-20260223215804, =0.0.0-00aadfd-20260223215804, =0.0.0-00aadfd-20260223215804, =0.0.0-00aadfd-20260223215804, =0.0.0-00aadfd-20260223215804, =0.0.0-00aadfd-20260223215804, =0.0.0-00aadfd-20260223215804, =3.9.2 Source cves: CVE-2026-55661 Source...

@tinacms/app (>=0.0.0-574b548-20260304015858, <=2.5.5), @tinacms/cli (>=0.0.0-1d830a0-20260128234746, <=2.5.0) +1 more potentially affected by CVE-2026-55661 via tinacms (>=3.0.0, <=3.9.2)

tinacms NPM version =3.0.0, =0.0.0-574b548-20260304015858, =0.0.0-1d830a0-20260128234746, =0.1.12, =0.2.14 Source cves: CVE-2026-55661 Source advisory: GHSA-2VCC-5V34-9JC8...

@tinacms/app (>=0.0.0-574b548-20260304015858, <=2.5.5), @tinacms/cli (>=0.0.0-1d830a0-20260128234746, <=2.5.0) +1 more potentially affected by CVE-2026-55661 via tinacms (>=3.0.0, <=3.9.2)

tinacms NPM version =3.0.0, =0.0.0-574b548-20260304015858, =0.0.0-1d830a0-20260128234746, =0.1.12, =0.2.14 Source cves: CVE-2026-55661 Source advisory: SNYK:JS-TINACMS-17420373...

@tinacms/app (>=0.0.0-07588d1-20260311013317, <=2.3.30), @tinacms/cli (>=0.0.0-07588d1-20260311013317, <=2.1.11) +4 more potentially affected by CVE-2026-34604 via @tinacms/graphql (>=2.0.0, <=2.2.0)

@tinacms/graphql NPM version =2.0.0, =0.0.0-07588d1-20260311013317, =0.0.0-07588d1-20260311013317, =2.0.0, =0.0.0-0b7103c-20251216023146, =0.0.0-07588d1-20260311013317, =0.0.0-07588d1-20260311013317, =3.6.3 Source cves: CVE-2026-34604 Source advisory: GHSA-G9C2-GF25-3X67...

@tinacms/app (>=0.0.0-07588d1-20260311013317, <=2.4.0), @tinacms/cli (>=0.0.0-07588d1-20260311013317, <=2.2.0) +4 more potentially affected by CVE-2026-34603 via @tinacms/graphql (>=2.0.0, <=2.2.1)

@tinacms/graphql NPM version =2.0.0, =0.0.0-07588d1-20260311013317, =0.0.0-07588d1-20260311013317, =2.0.0, =0.0.0-0b7103c-20251216023146, =0.0.0-07588d1-20260311013317, =0.0.0-07588d1-20260311013317, =3.7.0 Source cves: CVE-2026-34603 Source advisory: GHSA-G87C-R2JP-293W...

@tinacms/app (>=0.0.0-07588d1-20260311013317, <=2.4.0), @tinacms/cli (>=0.0.0-07588d1-20260311013317, <=2.2.0) +4 more potentially affected by CVE-2026-33949 via @tinacms/graphql (>=2.0.0, <=2.2.1)

@tinacms/graphql NPM version =2.0.0, =0.0.0-07588d1-20260311013317, =0.0.0-07588d1-20260311013317, =2.0.0, =0.0.0-0b7103c-20251216023146, =0.0.0-07588d1-20260311013317, =0.0.0-07588d1-20260311013317, =3.7.0 Source cves: CVE-2026-33949 Source advisory: GHSA-V9P7-GF3Q-H779...