Skip to content
OpenAdvisories

Product · tinacms

cli

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Medium 6.2
    CVE-2026-29066

    Arbitrary File Read via Disabled Vite Filesystem Restriction in TinaCMS CLI

    Tina is a headless content management system. Prior to 2.1.8, the TinaCMS CLI dev server configures Vite with server.fs.strict: false, which disables Vite's built-in filesystem access restriction. This allows any unauthenticated attacker who can reach the dev…

    tinacms cli @tinacms/cli npm