Tinacms vulnerabilities

Products

• Tinacms 16
• Next-tinacms-azure 2

Newest

• @tinacms app, tinacms +1 more TinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragment CVE-2026-108261 Fix available 9.3 CriticalOctober 9, 2026
• @tinacms web-components, tinacms +1 more @tinacms/web-components: `tina-markdown` writes rich-text link URLs into `href` without scheme validation, allowing stored XSS CVE-2026-108260 Fix available 7.6 HighOctober 9, 2026
• @tinacms cli, tinacms +1 more Tina: Code injection via unescaped Git branch name in generated client source CVE-2026-108259 Fix available 8.2 HighOctober 9, 2026
• @tinacms auth, tinacms next-tinacms-azure, tinacms +2 more Tina: [Broken Access Control] letting any TinaCloud user authorize against any self-hosted site CVE-2026-63506 Fix available 8.8 HighSeptember 16, 2026
• tinacms Tina: Cross-origin `POST /media/upload/*` requests can write arbitrary files into the Tina dev server media root CVE-2026-63123 Fix available 6.5 MediumAugust 19, 2026
• tinacms next-tinacms-azure, next-tinacms-cloudinary, next-tinacms-dos +2 more +4 more Tina: Broken Access Control: arbitrary bucket-key write/delete in `next-tinacms-s3` (and sibling production media adapters) CVE-2026-59992 Fix available 5.4 MediumAugust 19, 2026
• tinacms @tinacms/app, tinacms +1 more TinaCMS: Cross-origin postMessage handlers and rich-text URL-sanitization bypass enable stored XSS and session takeover CVE-2026-55660 Fix available 7.6 HighJune 19, 2026
• tinacms @tinacms/cli: Remote Code Execution via Forestry migration — unsanitised __TINA_INTERNAL__ marker in user-controlled YAML labels CVE-2026-54074 Fix available 7.8 HighJune 19, 2026
• tinacms @tinacms/mdx, tinacms +1 more TinaCMS rich-text (slatejson) rendering does not sanitize link/image URLs, allowing stored XSS via dangerous URL schemes CVE-2026-55661 Fix available 4.8 MediumJune 18, 2026
• tinacms, ssw tinacms\/graphql +1 more @tinacms/graphql's `FilesystemBridge` Path Validation Can Be Bypassed via Symlinks or Junctions CVE-2026-34604 Fix available 7.1 HighApril 1, 2026
• tinacms, ssw tinacms\/cli +1 more @tinacms/graphql's Media Endpoints Can Escape the Media Root via Symlinks or Junctions CVE-2026-34603 Fix available 7.1 HighApril 1, 2026
• tinacms, ssw tinacms\/graphql +1 more @tinacms/graphql has Path Traversal that leads to overwrite of arbitrary files CVE-2026-33949 Fix available 8.1 HighMarch 30, 2026
• tinacms, ssw tinacms\/cli +1 more Path Traversal in Media Upload Handle in Tina CVE-2026-28791 Fix available 7.4 HighMarch 12, 2026
• ssw tinacms, tinacms\/cli, tinacms\/graphql +2 more tinacms vulnerable to arbitrary code execution CVE-2025-68278 Fix available 7.3 HighDecember 18, 2025
• tinacms, ssw tinacms\/cli +1 more Tina search token leak via lock file in TinaCMS CVE-2024-45391 Fix available 7.5 HighSeptember 3, 2024
• tinacms, ssw tinacms\/cli +1 more Sensitive Information leak via Script File in TinaCMS CVE-2023-25164 Fix available 8.6 HighFebruary 8, 2023