TinaCMS - Path Traversal

TinaCMS CLI 2.1.8 contains a file system read vulnerability caused by disabled Vite server.fs.strict setting, letting unauthenticated attackers read arbitrary files on the host system, exploit requires access to the dev server. id: CVE-2026-29066 info: name: TinaCMS - Path Traversal author:...

CVE-2026-108259

Tina is a headless content management system. Prior to 3.0.0, @tinacms/cli reads Git branch values from VERCELGITCOMMITREF, GITHUBBRANCH, or HEAD, incorporates the raw value into the API URL, and interpolates that URL into JavaScript string literals in...

GHSA-PWHX-CVV3-QJ5C Tina: Code injection via unescaped Git branch name in generated client source

Summary @tinacms/cli inserts the raw Git branch value into the generated client.ts source without escaping or encoding. A Git-valid branch name can close the string literal and inject an arbitrary JavaScript expression that executes when the consumer build imports the generated client module...

Tina: Code injection via unescaped Git branch name in generated client source

Summary @tinacms/cli inserts the raw Git branch value into the generated client.ts source without escaping or encoding. A Git-valid branch name can close the string literal and inject an arbitrary JavaScript expression that executes when the consumer build imports the generated client module...

TinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragment

Summary The TinaCMS admin builds its preview from the // hash-router splat without checking that the value stays same-origin. A fragment with a doubled slash ///attacker.example/p becomes the protocol-relative URL //attacker.example/p, so the admin frames an external site. That same unvalidated...

@tinacms/app (>=0.0.0-574b548-20260304015858, <=2.5.9), @tinacms/cli (>=0.0.0-1c89c44-20260716070024, <=2.5.5) +1 more potentially affected by CVE-2026-108261 via tinacms (>=3.0.0, <=3.12.1)

tinacms NPM version =3.0.0, =0.0.0-574b548-20260304015858, =0.0.0-1c89c44-20260716070024, =0.0.0-f48009e-20260825053141, =0.2.18 Source cves: CVE-2026-108261 Source advisory: GHSA-X34J-47HF-4XG7...

@cloudcommerce/storefront (>=0.10.0, <=0.11.0), @gspenst/next (>=0.1.0, <=0.1.2) +6 more potentially affected by CVE-2026-108261 via @tinacms/app (>=2.0.0, <=2.5.12)

@tinacms/app NPM version =2.0.0, =0.10.0, =0.1.0, =0.1.0, =0.0.0-00a8b82-20260824011213, =0.0.2, =0.0.3, =0.1.1, =0.1.3 - ramidus 1.2.1 Source cves: CVE-2026-108261 Source advisory: GHSA-X34J-47HF-4XG7...

@tinacms/app (>=0.0.0-574b548-20260304015858, <=2.5.9), @tinacms/cli (>=0.0.0-1c89c44-20260716070024, <=2.5.5) +1 more potentially affected by CVE-2026-108261 via tinacms (>=3.0.0, <=3.12.1)

tinacms NPM version =3.0.0, =0.0.0-574b548-20260304015858, =0.0.0-1c89c44-20260716070024, =0.0.0-f48009e-20260825053141, =0.2.18 Source cves: CVE-2026-108261 Source advisory: OSV:GHSA-X34J-47HF-4XG7...

NPM: TinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragment

NPM: TinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragment vulnerability discovered by ? in WordPress Npm tinacms versions = 3.13.0...

@cloudcommerce/storefront (>=0.10.0, <=0.11.0), @gspenst/next (>=0.1.0, <=0.1.2) +6 more potentially affected by CVE-2026-108261 via @tinacms/app (>=2.0.0, <=2.5.12)

@tinacms/app NPM version =2.0.0, =0.10.0, =0.1.0, =0.1.0, =0.0.0-00a8b82-20260824011213, =0.0.2, =0.0.3, =0.1.1, =0.1.3 - ramidus 1.2.1 Source cves: CVE-2026-108261 Source advisory: OSV:GHSA-X34J-47HF-4XG7...

GHSA-X34J-47HF-4XG7 TinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragment

Summary The TinaCMS admin builds its preview from the // hash-router splat without checking that the value stays same-origin. A fragment with a doubled slash ///attacker.example/p becomes the protocol-relative URL //attacker.example/p, so the admin frames an external site. That same unvalidated...

GHSA-C42Q-QVC3-J6VG @tinacms/web-components: `tina-markdown` writes rich-text link URLs into `href` without scheme validation, allowing stored XSS

Summary renders a rich-text AST into the DOM and, for a nodes, assigns the node's URL straight to the anchor's href with no scheme check. A link authored in the CMS as javascript:… renders as a live javascript: anchor, so a visitor who clicks it executes attacker-supplied script in the site's...

@tinacms/web-components: `tina-markdown` writes rich-text link URLs into `href` without scheme validation, allowing stored XSS

Summary renders a rich-text AST into the DOM and, for a nodes, assigns the node's URL straight to the anchor's href with no scheme check. A link authored in the CMS as javascript:… renders as a live javascript: anchor, so a visitor who clicks it executes attacker-supplied script in the site's...

EUVD-2026-95990

Tina is a headless content management system. Prior to tinacms 3.14.0 and @tinacms/app 2.5.14, the // admin preview route in packages/tinacms/src/admin/index.tsx can turn an attacker-controlled hash-router splat into an off-origin iframe URL through packages/@tinacms/app/src/preview.tsx, while...

CVE-2026-108261 TinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragment

Tina is a headless content management system. Prior to tinacms 3.14.0 and @tinacms/app 2.5.14, the // admin preview route in packages/tinacms/src/admin/index.tsx can turn an attacker-controlled hash-router splat into an off-origin iframe URL through packages/@tinacms/app/src/preview.tsx, while...

@backpackjs/cli (>=1.0.0, <=2.0.0-bundle-perf-test.2), @backpackjs/cms (>=0.0.2, <=4.21.0) +48 more potentially affected by CVE-2026-108261 via tinacms (>=0.0.0-a0a8cb3-20260817041004, <=3.12.1)

tinacms NPM version =0.0.0-a0a8cb3-20260817041004, =1.0.0, =0.0.2, =2.2.0-isolate-nextjs.0, =1.0.0, =1.0.0, =0.1.0, =0.1.0, =0.10.0, =0.0.1-beta.1, =0.0.0-20220816134642, =0.0.0-20220903131031, =0.0.4, =0.1.0, =0.0.85, =0.0.89, =0.0.93 and more Source cves: CVE-2026-108261 Source advisory:...

@cloudcommerce/storefront (>=0.10.0, <=0.11.0), @gspenst/next (>=0.1.0, <=0.1.2) +6 more potentially affected by CVE-2026-108261 via @tinacms/app (>=0.0.0-a0a8cb3-20260817041004, <=2.5.12)

@tinacms/app NPM version =0.0.0-a0a8cb3-20260817041004, =0.10.0, =0.1.0, =0.1.0, =0.0.0-20220819182845, =0.0.2, =0.0.3, =0.1.1, =0.1.3 - ramidus 1.2.1 Source cves: CVE-2026-108261 Source advisory: MEND:CVE-2026-108261...

CVE-2026-108261 TinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragment

Tina is a headless content management system. Prior to tinacms 3.14.0 and @tinacms/app 2.5.14, the // admin preview route in packages/tinacms/src/admin/index.tsx can turn an attacker-controlled hash-router splat into an off-origin iframe URL through packages/@tinacms/app/src/preview.tsx, while...

CVE-2026-108261

Tina, a headless content management system, is vulnerable to an origin validation error in versions prior to tinacms 3.14.0 and @tinacms/app 2.5.14 . The vulnerability exists because the /~/* admin preview route can convert an attacker-controlled hash-router splat into an off-origin iframe URL vi...

CVE-2026-108260 @tinacms/web-components: `tina-markdown` writes rich-text link URLs into `href` without scheme validation, allowing stored XSS

Tina is a headless content management system. Prior to 0.2.1, the tina-markdown element in packages/@tinacms/web-components/src/tina-markdown.js assigns a rich-text node.url value directly to an anchor href without validating the URL scheme. A content author can store a link using a script-capabl...