CVE-2026-54074
1 advisory.
npm/@tinacms/cli CVE-2026-54074: high 7.8, EPSS 0.25%
@tinacms/cli: Remote Code Execution in @tinacms/cli via Forestry migration — unsanitised __TINA_INTERNAL__ marker in user-controlled YAML labels
Action: Upgrade @tinacms/cli to 2.4.3 or later.
npm i @tinacms/cli@2.4.3Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2.4.3 | - |
Fixed versions
| 2.4.3 |
Sources
- osv: GHSA-4936-9hrh-qqpw
- https://github.com/tinacms/tinacms/security/advisories/GHSA-4936-9hrh-qqpw
- https://github.com/tinacms/tinacms/pull/7006
- https://github.com/tinacms/tinacms/commit/77665ae73dd4f9563d339535e76fa811a8abdfbb
- https://github.com/tinacms/tinacms
- https://github.com/tinacms/tinacms/releases/tag/@tinacms/cli@2.4.3
CVE-2026-54074 · published · modified · JSON