TinaCMS: @tinacms/mdx code injection (CVE-2026-126774)
The @tinacms/mdx package before version 2.4.2 is vulnerable to code injection because the MDX serializer fails to properly escape rich-text values, allowing authenticated content editors to execute arbitrary JavaScript.
CVE search metadata
CVE search record: CVE-2026-126774. Severity: high. CVSS: 8.2. KEV: no. Product: @tinacms/mdx (< 2.4.2). Brief: TinaCMS: @tinacms/mdx code injection (CVE-2026-126774). Brief link: https://feed.craftedsignal.io/briefs/2026-11-tinacms-mdx-injection-cve-2026-126774/
Triage facts
Revision 1- Applicability
- @tinacms/mdx (< 2.4.2)
- Evidence
- Unknown
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Nov 11, 22:07 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
@tinacms/mdx before 2.4.2 contains a code injection vulnerability in its MDX serializer. The serializer writes rich-text values into MDX expressions without escaping them. Authenticated content editors can save crafted values that break out of list field or highlightColor expressions in the stored .mdx file, executing JavaScript in visitors' browsers or on build and server-side rendering hosts.
Impact
Successful exploitation allows an authenticated attacker to execute JavaScript in the context of the application. The vulnerability has a CVSS v3.1 base score of 8.2.
Recommendation
Update @tinacms/mdx to version 2.4.2 or later.