Skip to content
Threat Feed
Subscribe

Vendor

TinaCMS

4 briefs RSS
high advisory

Stored XSS via Unvalidated URL Scheme in @tinacms/web-components

The @tinacms/web-components package is vulnerable to stored Cross-Site Scripting (XSS) due to a failure to validate URL schemes in the tina-markdown component, allowing attackers to execute arbitrary code in the browser context of site visitors.

@tinacms/web-components xss web-components tinacms
2t 1c
high advisory

TinaCMS CLI Arbitrary Code Execution via Git Branch Name Injection

The TinaCMS CLI package fails to sanitize Git branch names during client code generation, allowing an attacker to inject and execute arbitrary JavaScript expressions within consumer build environments.

TinaCMS CLI supply-chain code-injection ci-cd rce
1t 1c
high advisory

TinaCMS Admin Iframe Origin Validation Bypass

TinaCMS improperly validates admin preview URLs, allowing attackers to frame external origins and hijack the postMessage trust channel to perform unauthorized GraphQL operations.

tinacms +1
2t
high advisory

Broken Access Control in TinaCMS Authorization

A broken access control vulnerability in @tinacms/auth allows attackers to perform unauthorized actions by supplying their own valid TinaCloud credentials against a victim's TinaCMS deployment.

@tinacms/auth +3
2t 1i