Skip to content
OpenAdvisories

Package · npm

@tinacms/cli

9 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Critical 9.7
    CVE-2026-28792

    Cross-Origin File Exfiltration via CORS Misconfiguration + Path Traversal in TinaCMS

    Tina is a headless content management system. Prior to 2.1.8 , the TinaCMS CLI dev server combines a permissive CORS configuration (Access-Control-Allow-Origin: *) with the path traversal vulnerability (previously reported) to enable a browser-based drive-by …

    tinacms cli @tinacms/cli npm