Cpe:2.3:a:tinacms:tinacms_mdx:*:*:*:*:*:*:*:*

The @tinacms/mdx package before version 2.4.2 is vulnerable to code injection because the MDX serializer fails to properly escape rich-text values, allowing authenticated content editors to execute arbitrary JavaScript.