Skip to content
OpenAdvisories

Product · tinacms

cli

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 8.2
    CVE-2026-108259

    Tina: Code injection via unescaped Git branch name in generated client source

    Tina is a headless content management system. Prior to 3.0.0, @tinacms/cli reads Git branch values from VERCEL_GIT_COMMIT_REF, GITHUB_BRANCH, or HEAD, incorporates the raw value into the API URL, and interpolates that URL into JavaScript string literals in pa…

    tinacms tinacms cli @tinacms/cli npm
  • High 8.4
    CVE-2026-28793

    Path Traversal Leading to Arbitrary File Read, Write and Delete in TinaCMS

    Tina is a headless content management system. Prior to 2.1.8, the TinaCMS CLI development server exposes media endpoints that are vulnerable to path traversal, allowing attackers to read and write arbitrary files on the filesystem outside the intended media d…

    tinacms cli @tinacms/cli npm