MEDIUM6.3npm
GHSA-2238-xc5r-v9hj· CVE-2026-24125@tinacms/graphql has a Path Traversal issue
Modified: 3/14/2026
package
npm/@tinacms/graphql
pkg:npm/%40tinacms/graphql
HIGHnpm
GHSA-529f-9qwm-9628· CVE-2025-68278tinacms is vulnerable to arbitrary code execution
Modified: 12/18/2025
HIGH7.1npm
GHSA-g87c-r2jp-293w· CVE-2026-34603@tinacms/graphql's Media Endpoints Can Escape the Media Root via Symlinks or Junctions
Modified: 4/6/2026
HIGH7.1npm
GHSA-g9c2-gf25-3x67· CVE-2026-34604@tinacms/graphql's `FilesystemBridge` Path Validation Can Be Bypassed via Symlinks or Junctions
Modified: 4/6/2026
HIGH8.1npm
GHSA-v9p7-gf3q-h779· CVE-2026-33949@tinacms/graphql has Path Traversal that leads to overwrite of arbitrary files
Modified: 4/6/2026