npm/@tinacms/app CVE-2026-108261: critical 9.3, EPSS 0.20%
TinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragment
Action: Upgrade @tinacms/app to 2.5.14 or later.
npm i @tinacms/app@2.5.14Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2.5.14 | - |
Fixed versions
| 2.5.14 |
Sources
- osv: GHSA-x34j-47hf-4xg7#npm/@tinacms/app
- https://github.com/tinacms/tinacms/security/advisories/GHSA-x34j-47hf-4xg7
- https://github.com/tinacms/tinacms/pull/7522
- https://github.com/tinacms/tinacms/commit/b57dbf4b56201aef15cd92caa49fd12ab96bbecf
- https://github.com/tinacms/tinacms
- https://github.com/tinacms/tinacms/releases/tag/@tinacms/app@2.5.14
- https://github.com/tinacms/tinacms/releases/tag/tinacms@3.14.0
CVE-2026-108261 · published · modified · JSON