@tinacms vulnerabilities

Newest CVEs

• CVE-2026-108261

  TinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragment

  tinacms · tinacms

  Critical9.3
• CVE-2026-108260

  @tinacms/web-components: `tina-markdown` writes rich-text link URLs into `href` without scheme validation, allowing stored XSS

  tinacms · tinacms

  High7.6
• CVE-2026-108259

  Tina: Code injection via unescaped Git branch name in generated client source

  tinacms · tinacms

  High8.2
• CVE-2026-63506

  Tina: [Broken Access Control] letting any TinaCloud user authorize against any self-hosted site

  tinacms · tinacms

  High8.8
• CVE-2026-29066

  Arbitrary File Read via Disabled Vite Filesystem Restriction in TinaCMS CLI

  @tinacms · cli

  Medium6.2
• CVE-2026-28793

  Path Traversal Leading to Arbitrary File Read, Write and Delete in TinaCMS

  @tinacms · cli

  High8.4
• CVE-2026-28792

  Cross-Origin File Exfiltration via CORS Misconfiguration + Path Traversal in TinaCMS

  @tinacms · cli

  Critical9.7
• CVE-2026-24125

  Path Traversal in @tinacms/graphql

  @tinacms · graphql

  Medium6.3