PT-2025-52689

Name of the Vulnerable Software and Affected Versions Hasura GraphQL version 1.3.3 Description The software is susceptible to a denial of service condition. Attackers can exploit this by sending specially crafted GraphQL queries containing deeply nested fields. These queries are designed to consu...

PT-2025-52691

Name of the Vulnerable Software and Affected Versions Hasura GraphQL version 1.3.3 Description A server-side request forgery issue exists in Hasura GraphQL. Attackers can inject arbitrary remote schema URLs through the add remote schema endpoint. Exploitation involves sending crafted POST request...

@tinacms/app (>=0.0.0-0b7103c-20251216023146, <=2.3.15), @tinacms/cli (>=0.0.0-0b7103c-20251216023146, <=2.0.3) +4 more potentially affected by CVE-2025-68278 via @tinacms/graphql (>=2.0.0, <=2.0.2)

@tinacms/graphql NPM version =2.0.0, =0.0.0-0b7103c-20251216023146, =0.0.0-0b7103c-20251216023146, =2.0.0, =0.0.0-0b7103c-20251216023146, =0.0.0-0b7103c-20251216023146, =0.0.0-0b7103c-20251216023146, =3.1.0 Source cves: CVE-2025-68278 Source advisory: SNYK:JS-TINACMSGRAPHQL-14535448...

@tinacms/app (>=0.0.0-0b7103c-20251216023146, <=2.3.15), @tinacms/cli (>=0.0.0-0b7103c-20251216023146, <=2.0.3) +4 more potentially affected by CVE-2025-68278 via @tinacms/graphql (>=2.0.0, <=2.0.2)

@tinacms/graphql NPM version =2.0.0, =0.0.0-0b7103c-20251216023146, =0.0.0-0b7103c-20251216023146, =2.0.0, =0.0.0-0b7103c-20251216023146, =0.0.0-0b7103c-20251216023146, =0.0.0-0b7103c-20251216023146, =3.1.0 Source cves: CVE-2025-68278 Source advisory: GHSA-529F-9QWM-9628...

EUVD-2025-204304

tinacms is vulnerable to arbitrary code execution...

Arbitrary Code Injection

Overview @tinacms/graphql is a GraphQL database generating component for Tina, the headless content management system with support for Markdown, MDX, JSON, YAML, and more. Affected versions of this package are vulnerable to Arbitrary Code Injection via the improper use of gray-matter package. An...

@tinacms/app (>=0.0.0-0b7103c-20251216023146, <=2.3.15), @tinacms/cli (>=0.0.0-0b7103c-20251216023146, <=2.0.3) +4 more potentially affected by CVE-2025-68278 via @tinacms/graphql (>=2.0.0, <=2.0.2)

@tinacms/graphql NPM version =2.0.0, =0.0.0-0b7103c-20251216023146, =0.0.0-0b7103c-20251216023146, =2.0.0, =0.0.0-0b7103c-20251216023146, =0.0.0-0b7103c-20251216023146, =0.0.0-0b7103c-20251216023146, =3.1.0 Source cves: CVE-2025-68278 Source advisory: OSV:GHSA-529F-9QWM-9628...

@bojidar-bg/tina-mdx-editor (>=0.1.0, <=0.1.1), @bojidar-bg/tina-simple-git-provider (>=0.1.0, <=0.1.1) +26 more potentially affected by CVE-2025-68278 via @tinacms/graphql (>=0.0.0-a1ff961-20250623024558, <=2.0.2)

@tinacms/graphql NPM version =0.0.0-a1ff961-20250623024558, =0.1.0, =0.1.0, =0.1.0, =0.10.0, =0.0.0-20230511135047, =0.0.0-20230511135047, =2.5.8-canary.50.602.0, =0.0.4, =0.0.85, =0.0.89, =0.0.26, =0.0.34, =0.0.0-20230523213000, =0.0.0-2022221839, =2.0.3 and more Source cves: CVE-2025-68278 Sour...

CVE-2025-68278 tinacms vulnerable to arbitrary code execution

Tina is a headless content management system. In tinacms prior to version 3.1.1, tinacms uses the gray-matter package in an insecure way allowing attackers that can control the content of the processed markdown files, e.g., blog posts, to execute arbitrary code. tinacms version 3.1.1, @tinacms/cl...

BIT-GITLAB-2025-11247 Authorization Bypass Through User-Controlled Key in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 13.2 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2 that could have allowed an authenticated user to disclose sensitive information from private projects by executing specifically crafted GraphQL queries...

PT-2025-52257

Name of the Vulnerable Software and Affected Versions Tina versions prior to 3.1.1 Description Tina is a headless content management system. Versions of Tina prior to 3.1.1 improperly utilize the gray-matter package, potentially allowing attackers who control the content of markdown files—such as...

This Week in Spring – December 16th, 2025

Hi, Spring fans! Welcome to another installment of This Week in Spring! And what a week it’s been! We’ve got around nine shopping days ’til Christmas, and the New Year is almost here! Things are moving so quickly and the Spring community is no exception! Let's dive into this week's wonderful...

GitLab GraphQL API Interface DoS

The vulnerability of the GraphQL API interface of a software platform based on Git for collaborative code development on GitLab is related to unlimited resource distribution. Exploiting this vulnerability allows a malicious actor to bypass security restrictions and cause service failures by sendi...

CVE-2025-12562

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.10 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2 that could have allowed an unauthenticated user to create a denial of service condition by sending crafted GraphQL queries that bypass query complexity limits...

CVE-2025-11247

GitLab has remediated an issue in GitLab EE affecting all versions from 13.2 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2 that could have allowed an authenticated user to disclose sensitive information from private projects by executing specifically crafted GraphQL queries...

Vulnerabilities fixed in GitLab CE/EE

GitLab has fixed vulnerabilities in GitLab CE/EE. The vulnerabilities include several issues, including the ability for authenticated users to upload malicious images, perform unauthorized actions by injecting malicious HTML, obtain sensitive information through GraphQL queries, and bypass WebAut...

CVE-2025-11247

GitLab has remediated an issue in GitLab EE affecting all versions from 13.2 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2 that could have allowed an authenticated user to disclose sensitive information from private projects by executing specifically crafted GraphQL queries...

CVE-2025-12562

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.10 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2 that could have allowed an unauthenticated user to create a denial of service condition by sending crafted GraphQL queries that bypass query complexity limits...

UBUNTU-CVE-2025-12562

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.10 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2 that could have allowed an unauthenticated user to create a denial of service condition by sending crafted GraphQL queries that bypass query complexity limits...

CVE-2025-11247 Authorization Bypass Through User-Controlled Key in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 13.2 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2 that could have allowed an authenticated user to disclose sensitive information from private projects by executing specifically crafted GraphQL queries...