{"action":"Upgrade @tinacms/mdx to 2.1.7 or later.","affected":[{"fixed":"2.1.7","introduced":"0"}],"component":"@tinacms/mdx","cve_ids":["CVE-2026-55661"],"ecosystem":"npm","epss":0.00405,"exploited":false,"fixed_versions":["2.1.7"],"ghsa_id":"GHSA-2vcc-5v34-9jc8","id":"tcs_01M5KEV4CFTSMMC6EEF1YF0D3E","modified_at":"2026-09-10T03:50:55.365499184Z","published_at":"2026-06-18T13:07:05Z","references":["https://osv.dev/vulnerability/GHSA-2vcc-5v34-9jc8","https://github.com/tinacms/tinacms/security/advisories/GHSA-2vcc-5v34-9jc8","https://github.com/tinacms/tinacms/pull/7056","https://github.com/tinacms/tinacms"],"severity":{"label":"medium"},"sources":[{"source":"osv","source_id":"GHSA-2vcc-5v34-9jc8#npm/@tinacms/mdx","url":"https://osv.dev/vulnerability/GHSA-2vcc-5v34-9jc8"}],"summary":"TinaCMS rich-text (slatejson) rendering does not sanitize link/image URLs, allowing stored XSS via dangerous URL schemes"}