{"action":"Upgrade @tinacms/graphql to 2.2.2 or later.","affected":[{"fixed":"2.2.2","introduced":"0"}],"component":"@tinacms/graphql","cve_ids":["CVE-2026-34604"],"ecosystem":"npm","epss":0.00379,"exploited":false,"fixed_versions":["2.2.2"],"ghsa_id":"GHSA-g9c2-gf25-3x67","id":"tcs_01M5KFR5MJKNTPQDYK3YNVN7F0","modified_at":"2026-04-06T17:04:10.068665Z","published_at":"2026-04-01T00:25:22Z","references":["https://osv.dev/vulnerability/GHSA-g9c2-gf25-3x67","https://github.com/tinacms/tinacms/security/advisories/GHSA-g9c2-gf25-3x67","https://nvd.nist.gov/vuln/detail/CVE-2026-34604","https://github.com/tinacms/tinacms/commit/f124eabaca10dac9a4d765c9e4135813c4830955","https://github.com/tinacms/tinacms"],"severity":{"label":"high","score":7.1},"sources":[{"source":"osv","source_id":"GHSA-g9c2-gf25-3x67","url":"https://osv.dev/vulnerability/GHSA-g9c2-gf25-3x67"}],"summary":"@tinacms/graphql's `FilesystemBridge` Path Validation Can Be Bypassed via Symlinks or Junctions"}