npm/tinacms CVE-2026-108261: critical 9.3, EPSS 0.20%
TinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragment
Action: Upgrade tinacms to 3.14.0 or later.
npm i tinacms@3.14.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 3.14.0 | - |
Fixed versions
| 3.14.0 |
Sources
- osv: GHSA-x34j-47hf-4xg7
- https://github.com/tinacms/tinacms/security/advisories/GHSA-x34j-47hf-4xg7
- https://github.com/tinacms/tinacms/pull/7522
- https://github.com/tinacms/tinacms/commit/b57dbf4b56201aef15cd92caa49fd12ab96bbecf
- https://github.com/tinacms/tinacms
- https://github.com/tinacms/tinacms/releases/tag/@tinacms/app@2.5.14
- https://github.com/tinacms/tinacms/releases/tag/tinacms@3.14.0
CVE-2026-108261 · published · modified · JSON