Product
The @tinacms/mdx package before version 2.4.2 is vulnerable to code injection because the MDX serializer fails to properly escape rich-text values, allowing authenticated content editors to execute arbitrary JavaScript.