Schwachstellen verstehen. Anwendungen schützen.

Hoch 09.10.2026

CVE-2026-108259

Tina: Code-Injection über ungesicherten Git-Branch-Namen im generierten Client-Quellcode

Eine Schwachstelle in TinaCMS CLI ermöglicht die Ausführung von beliebigem JavaScript-Code während des Build-Prozesses, da Git-Branch-Namen unmaskiert in generierten Client-Code eingefügt werden.

npm

@tinacms/cli

Hoch 17.09.2026

CVE-2026-63506

Tina: [Broken Access Control] letting any TinaCloud user authorize against any self-hosted site

npm

next-tinacms-azure, @tinacms/auth

Mittel 19.08.2026

CVE-2026-63123

Tina: Cross-origin `POST /media/upload/*` requests can write arbitrary files into the Tina dev server media root

npm

@tinacms/cli

Hoch 19.06.2026

CVE-2026-54074

@tinacms/cli: Remote Code Execution in @tinacms/cli via Forestry migration — unsanitised __TINA_INTERNAL__ marker in user-controlled YAML labels

npm

@tinacms/cli

Hoch 01.04.2026

CVE-2026-34603

@tinacms/graphql's Media Endpoints Can Escape the Media Root via Symlinks or Junctions

npm

@tinacms/graphql

Mittel 12.03.2026

CVE-2026-29066

TinaCMS CLI has Arbitrary File Read via Disabled Vite Filesystem Restriction

npm

@tinacms/cli

Hoch 12.03.2026

CVE-2026-28793

TinaCMS Vulnerable to Path Traversal Leading to Arbitrary File Read, Write and Delete

npm

@tinacms/cli

Kritisch 12.03.2026

CVE-2026-28792

TinaCMS CLI Dev Server Vulnerable to Cross-Origin File Exfiltration via CORS Misconfiguration + Path Traversal in TinaCMS

npm

@tinacms/cli

Hoch 12.03.2026

CVE-2026-28791

Tina: Path Traversal in Media Upload Handle

npm

tinacms

Hoch 18.12.2025

CVE-2025-68278

tinacms is vulnerable to arbitrary code execution

npm

tinacms, @tinacms/cli, @tinacms/graphql

Hoch 03.09.2024

CVE-2024-45391

Tina search token leak via lock file in TinaCMS

npm

@tinacms/cli

Hoch 08.02.2023

CVE-2023-25164

Sensitive Information leak via Script File in TinaCMS

npm

@tinacms/cli