Read the docs
TI-2025-41854 Aliases CVE-2025-68278GHSA-529f-9qwm-9628

tinacms vulnerable to arbitrary code execution

Priority HIGH 67CWE-94Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-94.

Summary

Tina is a headless content management system. In tinacms prior to version 3.1.1, tinacms uses the gray-matter package in an insecure way allowing attackers that can control the content of the processed markdown files, e.g., blog posts, to execute arbitrary code. tinacms version 3.1.1, @tinacms/cli version 2.0.4, and @tinacms/graphql version 2.0.3 contain a fix for the issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00479 41st percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed tinacms (npm): 3.1.1@tinacms/cli (npm): 2.0.4+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
tinacmstinacmstinacms < 3.1.1; @tinacms/cli < 2.0.4; @tinacms/graphql < 2.0.3—No fix listedCNA
—tinacms (npm)before 3.1.13.1.1Patch availableGHSA-529f-9qwm-9628
—@tinacms/cli (npm)before 2.0.42.0.4Patch availableGHSA-529f-9qwm-9628
—@tinacms/graphql (npm)before 2.0.32.0.3Patch availableGHSA-529f-9qwm-9628
  • tinacms Vendortinacms Affected tinacms < 3.1.1; @tinacms/cli < 2.0.4; @tinacms/graphql < 2.0.3 Fixed in — No fix listed CNA
  • tinacms (npm) Vendor— Affected before 3.1.1 Fixed in 3.1.1 Patch available GHSA-529f-9qwm-9628
  • @tinacms/cli (npm) Vendor— Affected before 2.0.4 Fixed in 2.0.4 Patch available GHSA-529f-9qwm-9628
  • @tinacms/graphql (npm) Vendor— Affected before 2.0.3 Fixed in 2.0.3 Patch available GHSA-529f-9qwm-9628

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:ssw:tinacms:*:*:*:*:*:node.js:*:*before 3.1.1Vulnerabletinacms
cpe:2.3:a:ssw:tinacms\/cli:*:*:*:*:*:node.js:*:*before 2.0.4Vulnerabletinacms
cpe:2.3:a:ssw:tinacms\/graphql:*:*:*:*:*:node.js:*:*before 2.0.3Vulnerabletinacms
  • cpe:2.3:a:ssw:tinacms:*:*:*:*:*:node.js:*:* Versions before 3.1.1 Vulnerable ·tinacms
  • cpe:2.3:a:ssw:tinacms\/cli:*:*:*:*:*:node.js:*:* Versions before 2.0.4 Vulnerable ·tinacms
  • cpe:2.3:a:ssw:tinacms\/graphql:*:*:*:*:*:node.js:*:* Versions before 2.0.3 Vulnerable ·tinacms

Remediation

  • Fix · GHSA-529f-9qwm-9628 tinacms (npm) Fixed in 3.1.1 Advisory →
  • Fix · GHSA-529f-9qwm-9628 @tinacms/cli (npm) Fixed in 2.0.4 Advisory →
  • Fix · GHSA-529f-9qwm-9628 @tinacms/graphql (npm) Fixed in 2.0.3 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-68278
  2. 2026-10-03 Alias added: GHSA-529f-9qwm-9628

References

Exploit 1

Patch 1

Advisory 1

Other 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences