Skip to content
OpenAdvisories

Package · npm

@tinacms/cli

9 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 6.5
    CVE-2026-63123

    Tina: Cross-origin `POST /media/upload/*` requests can write arbitrary files into the Tina dev server media root

    Tina is a headless content management system. Prior to 2.5.2, the TinaCMS CLI package's Vite dev server packages/@tinacms/cli/src/next/vite/cors.ts origin callback returns false for a disallowed origin but does not reject the request, and packages/@tinacms/cl…

    tinacms tinacms @tinacms/cli npm
  • Medium 6.2
    CVE-2026-29066 Scanner template

    Arbitrary File Read via Disabled Vite Filesystem Restriction in TinaCMS CLI

    Tina is a headless content management system. Prior to 2.1.8, the TinaCMS CLI dev server configures Vite with server.fs.strict: false, which disables Vite's built-in filesystem access restriction. This allows any unauthenticated attacker who can reach the dev…

    tinacms cli @tinacms/cli npm