tinacms vulnerabilities

CVEs per yearBy the year they were published

1. 20231
2. 20241
3. 20251
4. 202613

Newest CVEs

• CVE-2026-108261

  TinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragment

  tinacms · tinacms

  Critical9.3
• CVE-2026-108260

  @tinacms/web-components: `tina-markdown` writes rich-text link URLs into `href` without scheme validation, allowing stored XSS

  tinacms · tinacms

  High7.6
• CVE-2026-108259

  Tina: Code injection via unescaped Git branch name in generated client source

  tinacms · tinacms

  High8.2
• CVE-2026-63506

  Tina: [Broken Access Control] letting any TinaCloud user authorize against any self-hosted site

  tinacms · tinacms

  High8.8
• CVE-2026-63123

  Tina: Cross-origin `POST /media/upload/*` requests can write arbitrary files into the Tina dev server media root

  tinacms · tinacms

  Medium6.5
• CVE-2026-59992

  Tina: Broken Access Control: arbitrary bucket-key write/delete in `next-tinacms-s3` (and sibling production media adapters)

  tinacms · tinacms

  Medium5.4
• CVE-2026-55660

  TinaCMS: Cross-origin postMessage handlers and rich-text URL-sanitization bypass enable stored XSS and session takeover

  tinacms · tinacms

  High7.6
• CVE-2026-54074

  @tinacms/cli: Remote Code Execution via Forestry migration — unsanitised __TINA_INTERNAL__ marker in user-controlled YAML labels

  tinacms · tinacms

  High7.8
• CVE-2026-55661

  TinaCMS rich-text (slatejson) rendering does not sanitize link/image URLs, allowing stored XSS via dangerous URL schemes

  tinacms · tinacms

  Medium4.8
• CVE-2026-34603

  @tinacms/graphql's Media Endpoints Can Escape the Media Root via Symlinks or Junctions

  tinacms · tinacms

  High7.1