Read the docs
TI-2026-40183 Aliases CVE-2026-55660GHSA-g5qx-h5f3-mp2f

TinaCMS: Cross-origin postMessage handlers and rich-text URL-sanitization bypass enable stored XSS and session takeover

Priority LOW 35CWE-346Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
Present
Impact type
Security bypass, Spoofing, Cross-site scripting
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-346, CWE-601 and CWE-79.

Summary

Tina is a headless content management system. In versions prior to @tinacms/app 2.5.6 and tinacms 3.9.3, cross-origin postMessage handlers and a rich-text URL-sanitization bypass enable stored XSS and session takeover. The library registers window message listeners — the useTina overlay handler, the OAuth authentication popup handler, and the admin↔preview iframe GraphQL reducer — that act on event.data without verifying event.origin or event.source and post messages using non-specific target origins, while insufficient URL sanitization in rich-text content allows malicious URLs to persist and execute. A page the victim visits (or a window in an opener/iframe relationship with a Tina admin) can forge messages to drive the editor, inject preview content, or observe/forge the OAuth popup channel to take over an authenticated editing session. This issue has been fixed in versions @tinacms/app 2.5.6 and tinacms 3.9.3.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00279 20th percentileScored 2026-11-07
Fix Fixed tinacms (tinacms): 3.9.3@tinacms/app (tinacms): 2.5.6+2 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
tinacmstinacmsbefore 3.9.33.9.3Patch availableCNA
tinacms@tinacms/appbefore 2.5.62.5.6Patch availableCNA
—tinacms (npm)before 3.9.33.9.3Patch availableGHSA-g5qx-h5f3-mp2f
—@tinacms/app (npm)before 2.5.62.5.6Patch availableGHSA-g5qx-h5f3-mp2f
  • tinacms Vendortinacms Affected before 3.9.3 Fixed in 3.9.3 Patch available CNA
  • @tinacms/app Vendortinacms Affected before 2.5.6 Fixed in 2.5.6 Patch available CNA
  • tinacms (npm) Vendor— Affected before 3.9.3 Fixed in 3.9.3 Patch available GHSA-g5qx-h5f3-mp2f
  • @tinacms/app (npm) Vendor— Affected before 2.5.6 Fixed in 2.5.6 Patch available GHSA-g5qx-h5f3-mp2f

Remediation

  • Fix · CNA tinacms (tinacms) Fixed in 3.9.3
  • Fix · CNA @tinacms/app (tinacms) Fixed in 2.5.6
  • Fix · GHSA-g5qx-h5f3-mp2f tinacms (npm) Fixed in 3.9.3 Advisory →
  • Fix · GHSA-g5qx-h5f3-mp2f @tinacms/app (npm) Fixed in 2.5.6 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-55660
  2. 2026-10-03 Alias added: GHSA-g5qx-h5f3-mp2f

References

Other 3

  • TI-2026-22987 Cross-Origin File Exfiltration via CORS Misconfiguration + Path Traversal in TinaCMS CVSS 3.1CRITICAL 9.7
  • TI-2026-70295 TinaCMS admin preview frames attacker-controlled origin CVSS 3.1CRITICAL 9.3
  • TI-2026-45239 Tina: [Broken Access Control] letting any TinaCloud user authorize against any self-hosted site CVSS 3.1HIGH 8.8
  • TI-2026-26851 @tinacms/graphql's `FilesystemBridge` Path Validation Can Be Bypassed via Symlinks or Junctions CVSS 3.1HIGH 8.8
  • TI-2026-22988 Path Traversal Leading to Arbitrary File Read, Write and Delete in TinaCMS CVSS 3.1HIGH 8.4
  • TI-2026-70293 Code injection in Tina CLI via unescaped Git branch name CVSS 3.1HIGH 8.2
See all 19 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences