{"action":"Upgrade @tinacms/graphql to 2.2.2 or later.","affected":[{"fixed":"2.2.2","introduced":"0"}],"component":"@tinacms/graphql","cve_ids":["CVE-2026-33949"],"ecosystem":"npm","epss":0.00394,"exploited":false,"fixed_versions":["2.2.2"],"ghsa_id":"GHSA-v9p7-gf3q-h779","id":"tcs_01M5KGBDV9R857PWE4Q8RZSYC8","modified_at":"2026-04-06T17:04:33.962142Z","published_at":"2026-03-30T17:07:53Z","references":["https://osv.dev/vulnerability/GHSA-v9p7-gf3q-h779","https://github.com/tinacms/tinacms/security/advisories/GHSA-v9p7-gf3q-h779","https://nvd.nist.gov/vuln/detail/CVE-2026-33949","https://github.com/tinacms/tinacms"],"severity":{"label":"high","score":8.1},"sources":[{"source":"osv","source_id":"GHSA-v9p7-gf3q-h779","url":"https://osv.dev/vulnerability/GHSA-v9p7-gf3q-h779"}],"summary":"@tinacms/graphql has Path Traversal that leads to overwrite of arbitrary files"}