Vulnerabilities in @tinacms

8 results

CVE-2026-29066MEDIUMArbitrary File Read via Disabled Vite Filesystem Restriction in TinaCMS CLIEPSS 1.0%CVE-2026-28792CRITICALCross-Origin File Exfiltration via CORS Misconfiguration + Path Traversal in TinaCMSEPSS 0.6%CVE-2026-63506HIGHTina: [Broken Access Control] letting any TinaCloud user authorize against any self-hosted siteEPSS 0.5%CVE-2026-24125MEDIUMPath Traversal in @tinacms/graphqlEPSS 0.5%CVE-2026-108259HIGHTina: Code injection via unescaped Git branch name in generated client sourceEPSS 0.3%CVE-2026-108260HIGH@tinacms/web-components: `tina-markdown` writes rich-text link URLs into `href` without scheme validation, allowing stored XSSEPSS 0.3%CVE-2026-28793HIGHPath Traversal Leading to Arbitrary File Read, Write and Delete in TinaCMSEPSS 0.2%CVE-2026-108261CRITICALTinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragmentEPSS 0.2%