@tinacms/app vulnerabilities (npm)

2 vulnerabilities.

• @tinacms/app npm TinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragment CVE-2026-108261 Fix available 9.3 CriticalOctober 9, 2026
• @tinacms/app npm TinaCMS: Cross-origin postMessage handlers and rich-text URL-sanitization bypass enable stored XSS and session takeover CVE-2026-55660 Fix available 7.6 HighJune 19, 2026