@Tinacms/Mdx (< 2.4.2) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/@tinacms/mdx--2.4.2/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 11 Nov 2026 22:07:53 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgTinaCMS: @tinacms/mdx code injection (CVE-2026-126774)https://feed.craftedsignal.io/briefs/2026-11-tinacms-mdx-injection-cve-2026-126774/Wed, 11 Nov 2026 22:07:53 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-tinacms-mdx-injection-cve-2026-126774/The @tinacms/mdx package before version 2.4.2 is vulnerable to code injection because the MDX serializer fails to properly escape rich-text values, allowing authenticated content editors to execute arbitrary JavaScript.@tinacms/mdx before 2.4.2 contains a code injection vulnerability in its MDX serializer. The serializer writes rich-text values into MDX expressions without escaping them. Authenticated content editors can save crafted values that break out of list field or highlightColor expressions in the stored .mdx file, executing JavaScript in visitors' browsers or on build and server-side rendering hosts.

Impact

Successful exploitation allows an authenticated attacker to execute JavaScript in the context of the application. The vulnerability has a CVSS v3.1 base score of 8.2.

Recommendation

Update @tinacms/mdx to version 2.4.2 or later.

]]>highadvisory