{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3atinacmstinacms_mdx/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:tinacms:tinacms_mdx:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.2,"id":"CVE-2026-126774"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["@tinacms/mdx (\u003c 2.4.2)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["TinaCMS"],"content_html":"\u003cp\u003e@tinacms/mdx before 2.4.2 contains a code injection vulnerability in its MDX serializer. The serializer writes rich-text values into MDX expressions without escaping them. Authenticated content editors can save crafted values that break out of list field or highlightColor expressions in the stored .mdx file, executing JavaScript in visitors' browsers or on build and server-side rendering hosts.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an authenticated attacker to execute JavaScript in the context of the application. The vulnerability has a CVSS v3.1 base score of 8.2.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003eUpdate @tinacms/mdx to version 2.4.2 or later.\u003c/p\u003e\n","date_modified":"2026-11-11T22:07:53Z","date_published":"2026-11-11T22:07:53Z","id":"https://feed.craftedsignal.io/briefs/2026-11-tinacms-mdx-injection-cve-2026-126774/","summary":"The @tinacms/mdx package before version 2.4.2 is vulnerable to code injection because the MDX serializer fails to properly escape rich-text values, allowing authenticated content editors to execute arbitrary JavaScript.","title":"TinaCMS: @tinacms/mdx code injection (CVE-2026-126774)","url":"https://feed.craftedsignal.io/briefs/2026-11-tinacms-mdx-injection-cve-2026-126774/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:tinacms:tinacms_mdx:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}