{"action":"Upgrade tinacms to 3.14.0 or later.","affected":[{"fixed":"3.14.0","introduced":"0"}],"component":"tinacms","cve_ids":["CVE-2026-108261"],"ecosystem":"npm","epss":0.00197,"exploited":false,"fixed_versions":["3.14.0"],"ghsa_id":"GHSA-x34j-47hf-4xg7","id":"tcs_01M5KGGKFCXBMAG1YGG5Q2E2R1","modified_at":"2026-10-09T21:15:05.360447760Z","published_at":"2026-10-09T20:56:48Z","references":["https://osv.dev/vulnerability/GHSA-x34j-47hf-4xg7","https://github.com/tinacms/tinacms/security/advisories/GHSA-x34j-47hf-4xg7","https://github.com/tinacms/tinacms/pull/7522","https://github.com/tinacms/tinacms/commit/b57dbf4b56201aef15cd92caa49fd12ab96bbecf","https://github.com/tinacms/tinacms","https://github.com/tinacms/tinacms/releases/tag/@tinacms/app@2.5.14","https://github.com/tinacms/tinacms/releases/tag/tinacms@3.14.0"],"severity":{"label":"critical","score":9.3},"sources":[{"source":"osv","source_id":"GHSA-x34j-47hf-4xg7","url":"https://osv.dev/vulnerability/GHSA-x34j-47hf-4xg7"}],"summary":"TinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragment"}