@tinacms/app (>=0.0.0-00aadfd-20260223215804, <=2.5.5), @tinacms/cli (>=0.0.0-00aadfd-20260223215804, <=2.5.0) +5 more potentially affected by CVE-2026-55661 via @tinacms/mdx (>=2.0.0, <=2.1.6)

@tinacms/mdx NPM version =2.0.0, =0.0.0-00aadfd-20260223215804, =0.0.0-00aadfd-20260223215804, =0.0.0-00aadfd-20260223215804, =0.0.0-00aadfd-20260223215804, =0.0.0-00aadfd-20260223215804, =0.0.0-00aadfd-20260223215804, =0.0.0-00aadfd-20260223215804, =3.9.2 Source cves: CVE-2026-55661 Source...

@bojidar-bg/tina-mdx-editor (>=0.1.0, <=0.1.1), @bojidar-bg/tina-simple-git-provider (>=0.1.0, <=0.1.1) +25 more potentially affected by CVE-2026-34603 via @tinacms/graphql (>=0.0.0-a1ff961-20250623024558, <=2.2.1)

@tinacms/graphql NPM version =0.0.0-a1ff961-20250623024558, =0.1.0, =0.1.0, =0.1.0, =0.10.0, =0.0.0-20230511135047, =0.0.0-20230511135047, =2.5.8-canary.50.602.0, =0.0.4, =0.0.85, =0.0.89, =0.0.26, =0.0.34, =0.0.0-20230523213000, =0.0.0-2022221839, =2.2.0 and more Source cves: CVE-2026-34603 Sour...

CVE-2026-34604 @tinacms/graphql's `FilesystemBridge` Path Validation Can Be Bypassed via Symlinks or Junctions

Tina is a headless content management system. Prior to version 2.2.2, @tinacms/graphql uses string-based path containment checks in FilesystemBridge. That blocks plain ../ traversal, but it does not resolve symlink or junction targets. If a symlink/junction already exists under the allowed conten...

@bojidar-bg/tina-mdx-editor (>=0.1.0, <=0.1.1), @bojidar-bg/tina-simple-git-provider (>=0.1.0, <=0.1.1) +25 more potentially affected by CVE-2026-34604 via @tinacms/graphql (>=0.0.0-a1ff961-20250623024558, <=2.2.1)

@tinacms/graphql NPM version =0.0.0-a1ff961-20250623024558, =0.1.0, =0.1.0, =0.1.0, =0.10.0, =0.0.0-20230511135047, =0.0.0-20230511135047, =2.5.8-canary.50.602.0, =0.0.4, =0.0.85, =0.0.89, =0.0.26, =0.0.34, =0.0.0-20230523213000, =0.0.0-2022221839, =2.2.0 and more Source cves: CVE-2026-34604 Sour...

CVE-2026-33949 @tinacms/graphql has Path Traversal that leads to overwrite of arbitrary files

Tina is a headless content management system. Prior to version 2.2.2, a path traversal vulnerability in @tinacms/graphql allows unauthenticated users to write and overwrite arbitrary files within the project root. This is achieved by manipulating the relativePath parameter in GraphQL mutations. T...

@bojidar-bg/tina-mdx-editor (>=0.1.0, <=0.1.1), @bojidar-bg/tina-simple-git-provider (>=0.1.0, <=0.1.1) +25 more potentially affected by CVE-2026-33949 via @tinacms/graphql (>=0.0.0-a1ff961-20250623024558, <=2.2.1)

@tinacms/graphql NPM version =0.0.0-a1ff961-20250623024558, =0.1.0, =0.1.0, =0.1.0, =0.10.0, =0.0.0-20230511135047, =0.0.0-20230511135047, =2.5.8-canary.50.602.0, =0.0.4, =0.0.85, =0.0.89, =0.0.26, =0.0.34, =0.0.0-20230523213000, =0.0.0-2022221839, =2.2.0 and more Source cves: CVE-2026-33949 Sour...

CVE-2026-33949 @tinacms/graphql has Path Traversal that leads to overwrite of arbitrary files

Tina is a headless content management system. Prior to version 2.2.2, a path traversal vulnerability in @tinacms/graphql allows unauthenticated users to write and overwrite arbitrary files within the project root. This is achieved by manipulating the relativePath parameter in GraphQL mutations. T...

EUVD-2026-17961

Tina is a headless content management system. Prior to version 2.2.2, a path traversal vulnerability in @tinacms/graphql allows unauthenticated users to write and overwrite arbitrary files within the project root. This is achieved by manipulating the relativePath parameter in GraphQL mutations. T...

GHSA-G9C2-GF25-3X67 @tinacms/graphql's `FilesystemBridge` Path Validation Can Be Bypassed via Symlinks or Junctions

Summary @tinacms/graphql uses string-based path containment checks in FilesystemBridge: - path.resolvepath.joinbaseDir, filepath - startsWithresolvedBase + path.sep That blocks plain ../ traversal, but it does not resolve symlink or junction targets. If a symlink/junction already exists under the...

@tinacms/app (>=0.0.0-07588d1-20260311013317, <=2.3.30), @tinacms/cli (>=0.0.0-07588d1-20260311013317, <=2.1.11) +4 more potentially affected by CVE-2026-34604 via @tinacms/graphql (>=2.0.0, <=2.2.0)

@tinacms/graphql NPM version =2.0.0, =0.0.0-07588d1-20260311013317, =0.0.0-07588d1-20260311013317, =2.0.0, =0.0.0-0b7103c-20251216023146, =0.0.0-07588d1-20260311013317, =0.0.0-07588d1-20260311013317, =3.6.3 Source cves: CVE-2026-34604 Source advisory: GHSA-G9C2-GF25-3X67...

@tinacms/app (>=0.0.0-07588d1-20260311013317, <=2.4.0), @tinacms/cli (>=0.0.0-07588d1-20260311013317, <=2.2.0) +4 more potentially affected by CVE-2026-34604 via @tinacms/graphql (>=2.0.0, <=2.2.1)

@tinacms/graphql NPM version =2.0.0, =0.0.0-07588d1-20260311013317, =0.0.0-07588d1-20260311013317, =2.0.0, =0.0.0-0b7103c-20251216023146, =0.0.0-07588d1-20260311013317, =0.0.0-07588d1-20260311013317, =3.7.0 Source cves: CVE-2026-34604 Source advisory: OSV:GHSA-G9C2-GF25-3X67...

@tinacms/app (>=0.0.0-07588d1-20260311013317, <=2.4.0), @tinacms/cli (>=0.0.0-07588d1-20260311013317, <=2.2.0) +4 more potentially affected by CVE-2026-34604 via @tinacms/graphql (>=2.0.0, <=2.2.1)

@tinacms/graphql NPM version =2.0.0, =0.0.0-07588d1-20260311013317, =0.0.0-07588d1-20260311013317, =2.0.0, =0.0.0-0b7103c-20251216023146, =0.0.0-07588d1-20260311013317, =0.0.0-07588d1-20260311013317, =3.7.0 Source cves: CVE-2026-34604 Source advisory: SNYK:JS-TINACMSGRAPHQL-15870926...

@tinacms/app (>=0.0.0-07588d1-20260311013317, <=2.4.0), @tinacms/cli (>=0.0.0-07588d1-20260311013317, <=2.2.0) +4 more potentially affected by CVE-2026-34603 via @tinacms/graphql (>=2.0.0, <=2.2.1)

@tinacms/graphql NPM version =2.0.0, =0.0.0-07588d1-20260311013317, =0.0.0-07588d1-20260311013317, =2.0.0, =0.0.0-0b7103c-20251216023146, =0.0.0-07588d1-20260311013317, =0.0.0-07588d1-20260311013317, =3.7.0 Source cves: CVE-2026-34603 Source advisory: GHSA-G87C-R2JP-293W...

@tinacms/app (>=0.0.0-07588d1-20260311013317, <=2.4.0), @tinacms/cli (>=0.0.0-07588d1-20260311013317, <=2.2.0) +4 more potentially affected by CVE-2026-34603 via @tinacms/graphql (>=2.0.0, <=2.2.1)

@tinacms/graphql NPM version =2.0.0, =0.0.0-07588d1-20260311013317, =0.0.0-07588d1-20260311013317, =2.0.0, =0.0.0-0b7103c-20251216023146, =0.0.0-07588d1-20260311013317, =0.0.0-07588d1-20260311013317, =3.7.0 Source cves: CVE-2026-34603 Source advisory: OSV:GHSA-G87C-R2JP-293W...

CVE-2026-33949: Improper Limitation of a Pathname to a Restricted Directory

Tina is a headless content management system. Prior to version 2.2.2, a path traversal vulnerability in @tinacms/graphql allows unauthenticated users to write and overwrite arbitrary files within the project root. This is achieved by manipulating the relativePath parameter in GraphQL mutations. T...

CVE-2026-34604: Improper Limitation of a Pathname to a Restricted Directory

Tina is a headless content management system. Prior to version 2.2.2, @tinacms/graphql uses string-based path containment checks in FilesystemBridge. That blocks plain ../ traversal, but it does not resolve symlink or junction targets. If a symlink/junction already exists under the allowed conten...

GHSA-V9P7-GF3Q-H779 @tinacms/graphql has Path Traversal that leads to overwrite of arbitrary files

Summary A Path Traversal vulnerability in @tinacms/graphql allows unauthenticated users to write and overwrite arbitrary files within the project root. This is achieved by manipulating the relativePath parameter in GraphQL mutations. The impact includes the ability to replace critical server...

@tinacms/app (>=0.0.0-07588d1-20260311013317, <=2.4.0), @tinacms/cli (>=0.0.0-07588d1-20260311013317, <=2.2.0) +4 more potentially affected by CVE-2026-33949 via @tinacms/graphql (>=2.0.0, <=2.2.1)

@tinacms/graphql NPM version =2.0.0, =0.0.0-07588d1-20260311013317, =0.0.0-07588d1-20260311013317, =2.0.0, =0.0.0-0b7103c-20251216023146, =0.0.0-07588d1-20260311013317, =0.0.0-07588d1-20260311013317, =3.7.0 Source cves: CVE-2026-33949 Source advisory: OSV:GHSA-V9P7-GF3Q-H779...

@tinacms/app (>=0.0.0-07588d1-20260311013317, <=2.4.0), @tinacms/cli (>=0.0.0-07588d1-20260311013317, <=2.2.0) +4 more potentially affected by CVE-2026-33949 via @tinacms/graphql (>=2.0.0, <=2.2.1)

@tinacms/graphql NPM version =2.0.0, =0.0.0-07588d1-20260311013317, =0.0.0-07588d1-20260311013317, =2.0.0, =0.0.0-0b7103c-20251216023146, =0.0.0-07588d1-20260311013317, =0.0.0-07588d1-20260311013317, =3.7.0 Source cves: CVE-2026-33949 Source advisory: GHSA-V9P7-GF3Q-H779...

@tinacms/app (>=0.0.0-07588d1-20260311013317, <=2.4.0), @tinacms/cli (>=0.0.0-07588d1-20260311013317, <=2.2.0) +4 more potentially affected by CVE-2026-33949 via @tinacms/graphql (>=2.0.0, <=2.2.1)

@tinacms/graphql NPM version =2.0.0, =0.0.0-07588d1-20260311013317, =0.0.0-07588d1-20260311013317, =2.0.0, =0.0.0-0b7103c-20251216023146, =0.0.0-07588d1-20260311013317, =0.0.0-07588d1-20260311013317, =3.7.0 Source cves: CVE-2026-33949 Source advisory: SNYK:JS-TINACMSGRAPHQL-15855320...