npm/@tinacms/cli

TinaCMS Vulnerable to Path Traversal Leading to Arbitrary File Read, Write and Delete

Modified: 3/14/2026

@tinacms/cli: Remote Code Execution in @tinacms/cli via Forestry migration — unsanitised __TINA_INTERNAL__ marker in user-controlled YAML labels

Modified: 9/10/2026

Tina search token leak via lock file in TinaCMS

Modified: 9/3/2024

tinacms is vulnerable to arbitrary code execution

Modified: 12/18/2025

TinaCMS CLI Dev Server Vulnerable to Cross-Origin File Exfiltration via CORS Misconfiguration + Path Traversal in TinaCMS

Modified: 3/14/2026

TinaCMS CLI has Arbitrary File Read via Disabled Vite Filesystem Restriction

Modified: 3/14/2026

Sensitive Information leak via Script File in TinaCMS

Modified: 9/10/2026

Tina: Cross-origin `POST /media/upload/*` requests can write arbitrary files into the Tina dev server media root

Modified: 8/21/2026