MEDIUMnpm
GHSA-2vcc-5v34-9jc8· CVE-2026-55661TinaCMS rich-text (slatejson) rendering does not sanitize link/image URLs, allowing stored XSS via dangerous URL schemes
Modified: 9/10/2026
package
npm/tinacms
pkg:npm/tinacms
HIGHnpm
GHSA-529f-9qwm-9628· CVE-2025-68278tinacms is vulnerable to arbitrary code execution
Modified: 12/18/2025
HIGH7.4npm
GHSA-5hxf-c7j4-279c· CVE-2026-28791Tina: Path Traversal in Media Upload Handle
Modified: 3/14/2026
HIGHnpm
GHSA-g5qx-h5f3-mp2f· CVE-2026-55660TinaCMS: Cross-origin postMessage handlers and rich-text URL-sanitization bypass enable stored XSS and session takeover
Modified: 9/10/2026