@@tinacms

Products

Exploited and recent CVEs

• CVE-2026-108261 Critical 9.3 TinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragment 0.2%
• CVE-2026-108261 Critical 9.3 TinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragment 0.2%
• CVE-2026-108260 High 7.6 @tinacms/web-components: `tina-markdown` writes rich-text link URLs into `href` without scheme validation, allowing stored XSS 0.3%
• CVE-2026-108260 High 7.6 @tinacms/web-components: `tina-markdown` writes rich-text link URLs into `href` without scheme validation, allowing stored XSS 0.3%
• CVE-2026-108259 High 8.2 Tina: Code injection via unescaped Git branch name in generated client source 0.3%
• CVE-2026-108259 High 8.2 Tina: Code injection via unescaped Git branch name in generated client source 0.3%
• CVE-2026-63506 High 8.8 Tina: [Broken Access Control] letting any TinaCloud user authorize against any self-hosted site 0.5%
• CVE-2026-63506 High 8.8 Tina: [Broken Access Control] letting any TinaCloud user authorize against any self-hosted site 0.5%
• CVE-2026-63506 High 8.8 Tina: [Broken Access Control] letting any TinaCloud user authorize against any self-hosted site 0.5%
• CVE-2026-63123 Medium 6.5 Tina: Cross-origin `POST /media/upload/*` requests can write arbitrary files into the Tina dev server media root 0.3%
• CVE-2026-59992 Medium 5.4 Tina: Broken Access Control: arbitrary bucket-key write/delete in `next-tinacms-s3` (and sibling production media adapters) 0.4%
• CVE-2026-59992 Medium 5.4 Tina: Broken Access Control: arbitrary bucket-key write/delete in `next-tinacms-s3` (and sibling production media adapters) 0.4%
• CVE-2026-59992 Medium 5.4 Tina: Broken Access Control: arbitrary bucket-key write/delete in `next-tinacms-s3` (and sibling production media adapters) 0.4%
• CVE-2026-59992 Medium 5.4 Tina: Broken Access Control: arbitrary bucket-key write/delete in `next-tinacms-s3` (and sibling production media adapters) 0.4%
• CVE-2026-59992 Medium 5.4 Tina: Broken Access Control: arbitrary bucket-key write/delete in `next-tinacms-s3` (and sibling production media adapters) 0.4%
• CVE-2026-55660 High 7.6 TinaCMS: Cross-origin postMessage handlers and rich-text URL-sanitization bypass enable stored XSS and session takeover 0.3%
• CVE-2026-55660 High 7.6 TinaCMS: Cross-origin postMessage handlers and rich-text URL-sanitization bypass enable stored XSS and session takeover 0.3%
• CVE-2026-54074 High 7.8 @tinacms/cli: Remote Code Execution via Forestry migration — unsanitised __TINA_INTERNAL__ marker in user-controlled YAML labels 0.3%
• CVE-2026-55661 Medium 4.8 TinaCMS rich-text (slatejson) rendering does not sanitize link/image URLs, allowing stored XSS via dangerous URL schemes 0.4%
• CVE-2026-55661 Medium 4.8 TinaCMS rich-text (slatejson) rendering does not sanitize link/image URLs, allowing stored XSS via dangerous URL schemes 0.4%
• CVE-2026-34603 High 7.1 @tinacms/graphql's Media Endpoints Can Escape the Media Root via Symlinks or Junctions 0.4%
• CVE-2026-34604 High 7.1 @tinacms/graphql's `FilesystemBridge` Path Validation Can Be Bypassed via Symlinks or Junctions 0.4%
• CVE-2026-33949 High 8.1 @tinacms/graphql has Path Traversal that leads to overwrite of arbitrary files 0.4%
• CVE-2026-29066 Medium 6.2 Arbitrary File Read via Disabled Vite Filesystem Restriction in TinaCMS CLI 1.0%
• CVE-2026-28791 High 7.4 Path Traversal in Media Upload Handle in Tina 0.3%
• CVE-2026-28793 High 8.4 Path Traversal Leading to Arbitrary File Read, Write and Delete in TinaCMS 0.2%
• CVE-2026-28792 Critical 9.7 Cross-Origin File Exfiltration via CORS Misconfiguration + Path Traversal in TinaCMS 0.6%
• CVE-2026-24125 Medium 6.3 Path Traversal in @tinacms/graphql 0.5%
• CVE-2025-68278 High 7.3 tinacms vulnerable to arbitrary code execution 0.5%
• CVE-2024-45391 High 7.5 Tina search token leak via lock file in TinaCMS 0.3%