CVE-2026-108260
1 advisory.
npm/@tinacms/web-components CVE-2026-108260: high 7.6
@tinacms/web-components: `tina-markdown` writes rich-text link URLs into `href` without scheme validation, allowing stored XSS
Action: Upgrade @tinacms/web-components to 0.2.1 or later.
npm i @tinacms/web-components@0.2.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 0.2.1 | - |
Fixed versions
| 0.2.1 |
Sources
- osv: GHSA-c42q-qvc3-j6vg
- https://github.com/tinacms/tinacms/security/advisories/GHSA-c42q-qvc3-j6vg
- https://github.com/tinacms/tinacms/pull/7523
- https://github.com/tinacms/tinacms/commit/5295e077f0d279c35686a0e481a15e33a4877e3b
- https://github.com/tinacms/tinacms
- https://github.com/tinacms/tinacms/releases/tag/@tinacms/web-components@0.2.1
CVE-2026-108260 · published · modified · JSON