Skip to content
OpenAdvisories

Package · npm

@tinacms/app

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • Critical 9.3
    CVE-2026-108261

    TinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragment

    Tina is a headless content management system. Prior to tinacms 3.14.0 and @tinacms/app 2.5.14, the /~/* admin preview route in packages/tinacms/src/admin/index.tsx can turn an attacker-controlled hash-router splat into an off-origin iframe URL through package…

    tinacms tinacms app tinacms npm
  • High 7.6
    CVE-2026-55660

    TinaCMS: Cross-origin postMessage handlers and rich-text URL-sanitization bypass enable stored XSS and session takeover

    Tina is a headless content management system. In versions prior to @tinacms/app 2.5.6 and tinacms 3.9.3, cross-origin postMessage handlers and a rich-text URL-sanitization bypass enable stored XSS and session takeover. The library registers window message lis…

    tinacms tinacms @tinacms/app tinacms npm