CVE-2026-108259
HighCVSS 8.2Summary
Tina (headless CMS) versions prior to 3.0.0 — @tinacms/cli reads Git branch values from VERCEL_GIT_COMMIT_REF, GITHUB_BRANCH, or HEAD and interpolates the raw value into the API URL and JavaScript string literals in generated code. A crafted Git-valid branch name containing a quote can terminate the generated string and inject an expression that executes when the generated client module is imported during a preview build. The issue is fixed in version 3.0.0.
Risk Assessment
The injected code runs with build process privileges and can read environment credentials, modify deployment artifacts, or make network requests. The risk affects CI/CD processes building previews.
Recommendation
Update @tinacms/cli to version 3.0.0 or later. Restrict the ability to create arbitrarily named branches in repositories used for builds.
Other vulnerabilities in Tina
See all- CVE-2026-108260High
Tina (headless CMS) versions prior to 0.2.1 assign a rich-text node.url value directly to an anchor href without validating the URL scheme in the tina-markdown element. A content author can store a link using a script-capable scheme, and a visitor clicking the rendered link executes attacker-controlled script in the site's origin. The issue is fixed in version 0.2.1.
- CVE-2026-108261Critical
In versions prior to tinacms 3.14.0 and @tinacms/app 2.5.14, the /~/* admin preview route in Tina (a headless CMS) can turn an attacker-controlled hash-router splat into an off-origin iframe URL, while expectedOrigin for the GraphQL message channel is derived from that same URL. An unauthenticated attacker can send a crafted link to a signed-in editor, cause the admin to frame an attacker origin, and have that frame treated as the trusted preview, allowing GraphQL reads or mutations with the editor's credentials. This issue is fixed in tinacms 3.14.0 and @tinacms/app 2.5.14.
- CVE-2026-63506High
Tina is a headless content management system. Prior to @tinacms/auth 1.1.4 and next-tinacms-azure 15.0.1, isAuthorized accepts a request-controlled clientID and asks isUserAuthorized to validate the bearer token against that selected TinaCloud app instead of the self-hosted site's configured app. An attacker with any TinaCloud account can submit the attacker's own app ID and valid token to a victim endpoint, causing TinaCloudBackendAuthProvider or an affected media authorized callback to accept the attacker's verified status across the tenant boundary.
Original NVD description (English source)
Tina is a headless content management system. Prior to 3.0.0, @tinacms/cli reads Git branch values from VERCEL_GIT_COMMIT_REF, GITHUB_BRANCH, or HEAD, incorporates the raw value into the API URL, and interpolates that URL into JavaScript string literals in packages/@tinacms/cli/src/next/codegen/index.ts and packages/@tinacms/cli/src/next/codegen/codegen/plugin.ts. A crafted Git-valid branch name containing a quote can terminate the generated string and inject an expression that executes when the generated client module is imported during a preview build. The injected code runs with the build process privileges and can read environment credentials, modify deployment artifacts, or make network requests. This issue is fixed in version 3.0.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS