Skip to content
OpenAdvisories

Product · tinacms

app

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Critical 9.3
    CVE-2026-108261

    TinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragment

    Tina is a headless content management system. Prior to tinacms 3.14.0 and @tinacms/app 2.5.14, the /~/* admin preview route in packages/tinacms/src/admin/index.tsx can turn an attacker-controlled hash-router splat into an off-origin iframe URL through package…

    tinacms tinacms app tinacms npm