[ Vendor · 6 CVEs ]
tinacms
CVEs affecting tinacms published in the last 30 days, plus any tinacms CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-108259 | 9 Oct 2026 | CVSS 8.2 | Tina: Code injection via unescaped Git branch name in generated client sourceTina is a headless content management system. Prior to 3.0.0, @tinacms/cli reads Git branch values from VERCEL_GIT_COMMIT_REF, GITHUB_BRANCH, or… | Fix |
| CVE-2026-108259 | 9 Oct 2026 | CVSS 8.2 | Tina: Code injection via unescaped Git branch name in generated client sourceTina is a headless content management system. Prior to 3.0.0, @tinacms/cli reads Git branch values from VERCEL_GIT_COMMIT_REF, GITHUB_BRANCH, or… | Fix |
| CVE-2026-108260 | 9 Oct 2026 | CVSS 7.6 | @tinacms/web-components: `tina-markdown` writes rich-text link URLs into `href` without scheme validation, allowing stored XSSTina is a headless content management system. Prior to 0.2.1, the tina-markdown element in packages/@tinacms/web-components/src/tina-markdown.js… | Fix |
| CVE-2026-108260 | 9 Oct 2026 | CVSS 7.6 | @tinacms/web-components: `tina-markdown` writes rich-text link URLs into `href` without scheme validation, allowing stored XSSTina is a headless content management system. Prior to 0.2.1, the tina-markdown element in packages/@tinacms/web-components/src/tina-markdown.js… | Fix |
| CVE-2026-108261 | 9 Oct 2026 | CVSS 9.3 | TinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragmentTina is a headless content management system. Prior to tinacms 3.14.0 and @tinacms/app 2.5.14, the /~/* admin preview route in… | Fix |
| CVE-2026-108261 | 9 Oct 2026 | CVSS 9.3 | TinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragmentTina is a headless content management system. Prior to tinacms 3.14.0 and @tinacms/app 2.5.14, the /~/* admin preview route in… | Fix |