What’s Vulnerable › Products
tinacms vulnerabilities
17 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 15 published in the last 12 months.
Check whether your tinacms version is affected
Latest tinacms vulnerabilities
- CVE-2026-108261 — TinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragment (CVSS 9.3)
- CVE-2026-108260 — @tinacms/web-components: `tina-markdown` writes rich-text link URLs into `href` without scheme validation, allowing stored XSS (CVSS 7.6)
- CVE-2026-108259 — Tina: Code injection via unescaped Git branch name in generated client source (CVSS 8.2)
- CVE-2026-63506 — Tina: [Broken Access Control] letting any TinaCloud user authorize against any self-hosted site (CVSS 8.8)
- CVE-2026-63123 — Tina: Cross-origin `POST /media/upload/*` requests can write arbitrary files into the Tina dev server media root (CVSS 6.5)
- CVE-2026-59992 — Tina: Broken Access Control: arbitrary bucket-key write/delete in `next-tinacms-s3` (and sibling production media adapters) (CVSS 5.4)
- CVE-2026-55661 — TinaCMS rich-text (slatejson) rendering does not sanitize link/image URLs, allowing stored XSS via dangerous URL schemes (CVSS 4.8)
- CVE-2026-55660 — TinaCMS: Cross-origin postMessage handlers and rich-text URL-sanitization bypass enable stored XSS and session takeover (CVSS 7.6)
- CVE-2026-54074 — @tinacms/cli: Remote Code Execution via Forestry migration — unsanitised __TINA_INTERNAL__ marker in user-controlled YAML labels (CVSS 7.8)
- CVE-2026-34603 — @tinacms/graphql's Media Endpoints Can Escape the Media Root via Symlinks or Junctions (CVSS 8.3)
- CVE-2026-29066 — Arbitrary File Read via Disabled Vite Filesystem Restriction in TinaCMS CLI (CVSS 6.2)
- CVE-2026-28793 — Path Traversal Leading to Arbitrary File Read, Write and Delete in TinaCMS (CVSS 8.4)
- CVE-2026-28792 — Cross-Origin File Exfiltration via CORS Misconfiguration + Path Traversal in TinaCMS (CVSS 9.6)
- CVE-2026-28791 — Path Traversal in Media Upload Handle in Tina (CVSS 7.4)
- CVE-2025-68278 — tinacms vulnerable to arbitrary code execution (CVSS 8.8)
- CVE-2024-45391 — Tina search token leak via lock file in TinaCMS (CVSS 7.5)
- CVE-2023-25164 — Sensitive Information leak via Script File in TinaCMS (CVSS 7.5)