Vulnpedia
← Search CVEs

CVE-2026-108261

CRITICAL 9.3

Published 2026-10-09 · Last modified 2026-10-13

Tina is a headless content management system. Prior to tinacms 3.14.0 and @tinacms/app 2.5.14, the /~/* admin preview route in packages/tinacms/src/admin/index.tsx can turn an attacker-controlled hash-router splat into an off-origin iframe URL through packages/@tinacms/app/src/preview.tsx, while packages/@tinacms/app/src/lib/preview-origin.ts derives expectedOrigin from that same URL for the GraphQL message channel in packages/@tinacms/app/src/lib/graphql-reducer.ts. An unauthenticated attacker can send a crafted link to a signed-in editor, cause the admin to frame an attacker origin, and have that frame treated as the trusted preview. The attacker-controlled frame can submit GraphQL reads or mutations that the admin executes with the editor credentials, exposing or modifying protected content. This issue is fixed in tinacms 3.14.0 and @tinacms/app 2.5.14.

ELEVATED IMPACT

Severe if exploited (CVSS 9.3), but no known exploitation and low modeled probability. Patch on a normal cadence.

Exploitation likelihood

0.2%chance of exploitation in 30 days · 9th percentile

○ In CISA KEV ○ Catalogued PoC

Impact if exploited

9.3CVSS 3.1 · CRITICAL

  • ConfidentialityHigh
  • IntegrityHigh
  • AvailabilityNone

What an attacker needs

  • ✓Access: Reachable over the network — no local access needed
  • ✓Privileges: No account or privileges required
  • ⚠User interaction: A user must take an action (click / open a file)
  • ✓Complexity: No special conditions — reliably repeatable

✓ lowers the bar for an attacker · ⚠ raises it

Proof of concept

No public PoC is currently catalogued.

Search for new PoCs

Search GitHub now — results may be empty or unverified.

Tracked sources are checked daily for recent CVEs, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.

Data snapshot:

Affected

Vendors Tinacms @Tinacms

Products Tinacms App

Weakness (CWE)

  • CWE-346: : Origin Validation Error
  • CWE-441: : Unintended Proxy or Intermediary ('Confused Deputy')
  • CWE-601: : URL Redirection to Untrusted Site ('Open Redirect')

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

References and research data (JSON)

Packages and version ranges

Each advisory describes its own package and affected ranges. A boundary applies to that range; it is not a universal upgrade recommendation.

  • tinacms npm

    pkg:npm/tinacms

    SEMVER range
    • All earlier versions (introduced 0)
    • Fixed boundary (excluded): 3.14.0
    Additional upstream package constraints
    {
  "database": {
    "last_known_affected_version_range": "<= 3.13.0",
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-x34j-47hf-4xg7/GHSA-x34j-47hf-4xg7.json"
  }
}
    GitHub Advisory Database · GHSA-x34j-47hf-4xg7 · Updated 2026-10-09T21:15:05.360447760Z
  • @tinacms/app npm

    pkg:npm/%40tinacms/app

    SEMVER range
    • All earlier versions (introduced 0)
    • Fixed boundary (excluded): 2.5.14
    Additional upstream package constraints
    {
  "database": {
    "last_known_affected_version_range": "<= 2.5.13",
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-x34j-47hf-4xg7/GHSA-x34j-47hf-4xg7.json"
  }
}
    GitHub Advisory Database · GHSA-x34j-47hf-4xg7 · Updated 2026-10-09T21:15:05.360447760Z

All CVSS metrics

  • CRITICAL 9.3 v3.1 · CNA Primary
    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
  • CRITICAL 9.3 v3.1 · NVD Secondary
    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

References

Exploit-tagged references (not proof of a PoC)

Advisories

Technical & other

Sources: NVD · CVE.org · EPSS