{"action":"Upgrade @tinacms/web-components to 0.2.1 or later.","affected":[{"fixed":"0.2.1","introduced":"0"}],"component":"@tinacms/web-components","cve_ids":["CVE-2026-108260"],"ecosystem":"npm","epss":0.00254,"exploited":false,"fixed_versions":["0.2.1"],"ghsa_id":"GHSA-c42q-qvc3-j6vg","id":"tcs_01M5KFHN1DNE6ENMJ57K9CS81T","modified_at":"2026-10-09T21:15:04.363433366Z","published_at":"2026-10-09T20:56:45Z","references":["https://osv.dev/vulnerability/GHSA-c42q-qvc3-j6vg","https://github.com/tinacms/tinacms/security/advisories/GHSA-c42q-qvc3-j6vg","https://github.com/tinacms/tinacms/pull/7523","https://github.com/tinacms/tinacms/commit/5295e077f0d279c35686a0e481a15e33a4877e3b","https://github.com/tinacms/tinacms","https://github.com/tinacms/tinacms/releases/tag/@tinacms/web-components@0.2.1"],"severity":{"label":"high","score":7.6},"sources":[{"source":"osv","source_id":"GHSA-c42q-qvc3-j6vg","url":"https://osv.dev/vulnerability/GHSA-c42q-qvc3-j6vg"}],"summary":"@tinacms/web-components: `tina-markdown` writes rich-text link URLs into `href` without scheme validation, allowing stored XSS"}