CVE-2026-108260 Details
Description
Tina is a headless content management system. Prior to 0.2.1, the tina-markdown element in packages/@tinacms/web-components/src/tina-markdown.js assigns a rich-text node.url value directly to an anchor href without validating the URL scheme. A content author can store a link using a script-capable scheme, and a visitor who clicks the rendered link executes attacker-controlled script in the site's origin. The script can access same-origin application data and, when the visitor is an editor or administrator, may expose credentials stored by the TinaCMS admin on that origin. This issue is fixed in version 0.2.1.
A stored cross-site scripting vulnerability has been identified in TinaCMS versions prior to 0.2.1. The issue arises in the 'tina-markdown' web component, which processes rich-text link URLs without validating the URL scheme. This oversight allows content authors to inject links using script-based schemes, such as 'javascript:', which, when clicked by visitors, execute attacker-controlled scripts in the context of the site's origin. The vulnerability can access same-origin application data and, for users with editor or administrator privileges, may expose sensitive credentials stored by TinaCMS.
Users can update to TinaCMS version 0.2.1 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 9, 2026CISA-ADP
Assessed Oct 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/tinacms/tinacms/security/advisories/GHSA-c42q-qvc3-j6vg | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/tinacms/tinacms/commit/5295e077f0d279c35686a0e481a15e33a4877e3b | [email protected] | Source CodeVendor |
| https://github.com/tinacms/tinacms/pull/7523 | [email protected] | Issue TrackingVendor |
| https://github.com/tinacms/tinacms/releases/tag/@tinacms/[email protected] | [email protected] | Release NotesVendor |
| https://github.com/tinacms/tinacms/security/advisories/GHSA-c42q-qvc3-j6vg | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
| CWE-83 | Improper Neutralization of Script in Attributes in a Web Page | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Tina | <= 0.2.0 (semver) |
CPE
Remediation
| |
| TinaCMS | All versions |
CPE
Remediation
| |
| TinaCMS Tina-Markdown | <= 0.2.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 13, 2026 | CVE Modified | CISA-ADP |
| Oct 9, 2026 | New CVE Received | [email protected] |