What’s Vulnerable › Vulnerabilities

CVE-2026-55661: TinaCMS rich-text (slatejson) rendering does not sanitize link/image URLs, allowing stored XSS via dangerous URL schemes

• Severity: medium (CVSS 4.8 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-07-01 · updated 2026-07-06
• Weakness: CWE-79

Description

Tina is a headless content management system. In versions prior to @tinacms/mdx 2.1.7 and tinacms 3.9.3, rich-text parsing and the default link/image renderers did not sanitize the url field on Slate link/image nodes. Content containing javascript: or data:text/html URLs — including case-variant, whitespace-padded, and control-character-obfuscated forms — is rendered into href/src and executes when the content is viewed. Any actor able to author rich-text content (for example a lower-privileged editor, or imported/external content) can achieve stored XSS against editors and site viewers. This issue is fixed in versions @tinacms/mdx 2.1.7 and tinacms 3.9.3.

Affected products

• tinacms: before 3.9.3
• tinacms @tinacms/mdx: before 2.1.7

References

• https://github.com/tinacms/tinacms/pull/7056
• https://github.com/tinacms/tinacms/security/advisories/GHSA-2vcc-5v34-9jc8

Get alerted when CVE-2026-55661 or the next vulnerability affects your stack