{"action":"Upgrade @tinacms/app to 2.5.14 or later.","affected":[{"fixed":"2.5.14","introduced":"0"}],"component":"@tinacms/app","cve_ids":["CVE-2026-108261"],"ecosystem":"npm","epss":0.00197,"exploited":false,"fixed_versions":["2.5.14"],"ghsa_id":"GHSA-x34j-47hf-4xg7","id":"tcs_01M5KGGKPMGBWZA0YP42TFFKMG","modified_at":"2026-10-09T21:15:05.360447760Z","published_at":"2026-10-09T20:56:48Z","references":["https://osv.dev/vulnerability/GHSA-x34j-47hf-4xg7","https://github.com/tinacms/tinacms/security/advisories/GHSA-x34j-47hf-4xg7","https://github.com/tinacms/tinacms/pull/7522","https://github.com/tinacms/tinacms/commit/b57dbf4b56201aef15cd92caa49fd12ab96bbecf","https://github.com/tinacms/tinacms","https://github.com/tinacms/tinacms/releases/tag/@tinacms/app@2.5.14","https://github.com/tinacms/tinacms/releases/tag/tinacms@3.14.0"],"severity":{"label":"critical","score":9.3},"sources":[{"source":"osv","source_id":"GHSA-x34j-47hf-4xg7#npm/@tinacms/app","url":"https://osv.dev/vulnerability/GHSA-x34j-47hf-4xg7"}],"summary":"TinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragment"}