tinacms app vulnerabilities

Latest tinacms app CVEs

Newest publication first

1. CVE-2026-108261 TinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragment

   Published 2026-10-09

   Critical·CVSS 9.3 EPSS 0.20%

   Tina is a headless content management system. Prior to tinacms 3.14.0 and @tinacms/app 2.5.14, the /~/* admin preview route in packages/tinacms/src/admin/index.tsx can turn an attacker-controlled hash-router splat into an off-origin iframe URL through packages/@tinacms/app/src/pr...

2. CVE-2026-55660 TinaCMS: Cross-origin postMessage handlers and rich-text URL-sanitization bypass enable stored XSS and session takeover

   Published 2026-07-01

   High·CVSS 7.6 EPSS 0.28%

   Tina is a headless content management system. In versions prior to @tinacms/app 2.5.6 and tinacms 3.9.3, cross-origin postMessage handlers and a rich-text URL-sanitization bypass enable stored XSS and session takeover. The library registers window message listeners — the useTina...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.