Skip to content
OpenAdvisories

Vendor

tinacms

21 known vulnerabilities.

Products

tinacms 16 cli 4 @tinacms/mdx 2 next-tinacms-azure 2 app 1 next-tinacms-s3 1 next-tinacms-dos 1 next-tinacms-cloudinary 1 web-components 1 @tinacms/app 1 graphql 1 auth 1
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Critical 9.3
    CVE-2026-108261

    TinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragment

    Tina is a headless content management system. Prior to tinacms 3.14.0 and @tinacms/app 2.5.14, the /~/* admin preview route in packages/tinacms/src/admin/index.tsx can turn an attacker-controlled hash-router splat into an off-origin iframe URL through package…

    tinacms tinacms app tinacms npm
  • Critical 9.7
    CVE-2026-28792

    Cross-Origin File Exfiltration via CORS Misconfiguration + Path Traversal in TinaCMS

    Tina is a headless content management system. Prior to 2.1.8 , the TinaCMS CLI dev server combines a permissive CORS configuration (Access-Control-Allow-Origin: *) with the path traversal vulnerability (previously reported) to enable a browser-based drive-by …

    tinacms cli @tinacms/cli npm