CVE-2026-55661

MediumCVSS 4.8

Published: 01/07/2026(UTC)Updated: 06/07/2026(UTC)Translated: 07/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.24%

15th percentile - higher than 15% of all known CVEs

Summary

A stored XSS vulnerability exists in the Tina CMS rich-text component. The URL field in Slate link/image nodes is not sanitized, allowing injection of javascript: or data:text/html URLs. An attacker with content editing privileges can achieve stored XSS that executes when content is viewed by editors or site visitors.

Risk Assessment

The organization faces risks of session theft, account takeover of editors, and malicious content display to site visitors. The vulnerability can be exploited by low-privileged users or through imported external content.

Recommendation

Immediately update @tinacms/mdx to version 2.1.7 or later and tinacms to version 3.9.3 or later. After updating, scan existing content for malicious URLs.

Other vulnerabilities in Tina CMS

CVE-2026-55660High
A vulnerability in the Tina headless CMS allows stored XSS and session takeover via unverified postMessage handlers and insufficient URL sanitization in rich-text content. An attacker can forge messages to hijack an authenticated editing session.

Original NVD description (English source)

Tina is a headless content management system. In versions prior to @tinacms/mdx 2.1.7 and tinacms 3.9.3, rich-text parsing and the default link/image renderers did not sanitize the url field on Slate link/image nodes. Content containing javascript: or data:text/html URLs — including case-variant, whitespace-padded, and control-character-obfuscated forms — is rendered into href/src and executes when the content is viewed. Any actor able to author rich-text content (for example a lower-privileged editor, or imported/external content) can achieve stored XSS against editors and site viewers. This issue is fixed in versions @tinacms/mdx 2.1.7 and tinacms 3.9.3.