Read the docs
TI-2026-70294 Aliases CVE-2026-108260GHSA-c42q-qvc3-j6vg

Stored XSS via unvalidated link URLs in @tinacms/web-components tina-markdown

Priority HIGH 66CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
High · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

The tina-markdown element in @tinacms/web-components assigns a rich-text node.url value directly to an anchor href without validating the URL scheme. A content author can store a link using a script-capable scheme, and when a visitor clicks it, the script runs in the site's origin, reads same-origin application data and, if the visitor is an editor or administrator, may expose credentials stored by the TinaCMS admin on that origin. CWE-79 and CWE-83 apply, with a CVSS 3.1 base score of 7.6 (HIGH). CISA has not listed it in KEV, and CISA SSVC rates exploitation as PoC, not automatable, with partial technical impact.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

Tina is a headless content management system. Prior to 0.2.1, the tina-markdown element in packages/@tinacms/web-components/src/tina-markdown.js assigns a rich-text node.url value directly to an anchor href without validating the URL scheme. A content author can store a link using a script-capable scheme, and a visitor who clicks the rendered link executes attacker-controlled script in the site's origin. The script can access same-origin application data and, when the visitor is an editor or administrator, may expose credentials stored by the TinaCMS admin on that origin. This issue is fixed in version 0.2.1.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00254 16th percentileScored 2026-11-07
Fix Fixed tinacms (tinacms): 3.14.0web-components (@tinacms): 0.2.1+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
tinacmstinacmsbefore 3.14.03.14.0Patch availableCNA
tinacmsweb-componentsbefore 0.2.10.2.1Patch availableCNA
—@tinacms/web-components (npm)before 0.2.10.2.1Patch availableGHSA-c42q-qvc3-j6vg
  • tinacms Vendortinacms Affected before 3.14.0 Fixed in 3.14.0 Patch available CNA
  • web-components Vendortinacms Affected before 0.2.1 Fixed in 0.2.1 Patch available CNA
  • @tinacms/web-components (npm) Vendor— Affected before 0.2.1 Fixed in 0.2.1 Patch available GHSA-c42q-qvc3-j6vg

Remediation

Upgrade @tinacms/web-components to version 0.2.1, which fixes the issue. Versions before 0.2.1 are affected.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA tinacms (tinacms) Fixed in 3.14.0
  • Fix · CNA web-components (@tinacms) Fixed in 0.2.1
  • Fix · GHSA-c42q-qvc3-j6vg @tinacms/web-components (npm) Fixed in 0.2.1 Advisory →

Timeline

  1. 2026-10-10 Threatist record created from CVE-2026-108260
  2. 2026-10-10 Alias added: GHSA-c42q-qvc3-j6vg
  3. 2026-10-10 Fix available: npm/@tinacms/[email protected] · GHSA-c42q-qvc3-j6vg
  4. 2026-10-10 CVSS score added · GHSA-c42q-qvc3-j6vg
  5. 2026-10-10 Weakness changed · GHSA-c42q-qvc3-j6vg
  6. 2026-10-10 5 new references · GHSA-c42q-qvc3-j6vg
  7. 2026-10-11 Priority changed: MEDIUM → LOW
  8. 2026-10-13 CISA SSVC decision points changed
  9. 2026-10-13 Priority changed: LOW → HIGH

References

Other 5

  • TI-2026-22987 Cross-Origin File Exfiltration via CORS Misconfiguration + Path Traversal in TinaCMS CVSS 3.1CRITICAL 9.7
  • TI-2026-70295 TinaCMS admin preview frames attacker-controlled origin CVSS 3.1CRITICAL 9.3
  • TI-2026-45239 Tina: [Broken Access Control] letting any TinaCloud user authorize against any self-hosted site CVSS 3.1HIGH 8.8
  • TI-2026-26851 @tinacms/graphql's `FilesystemBridge` Path Validation Can Be Bypassed via Symlinks or Junctions CVSS 3.1HIGH 8.8
  • TI-2026-22988 Path Traversal Leading to Arbitrary File Read, Write and Delete in TinaCMS CVSS 3.1HIGH 8.4
  • TI-2026-70293 Code injection in Tina CLI via unescaped Git branch name CVSS 3.1HIGH 8.2
See all 19 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences