CVE-2026-54074 Details
Description
Tina is a headless content management system. @tinacms/cli versions prior to 2.4.3 contain a Remote Code Execution vulnerability in the Forestry-to-Tina migration command. The internal helper addVariablesToCode unquotes any value matching the marker "__TINA_INTERNAL__:::(.*?):::" inside the stringified collection JSON. User-supplied label and name fields from .forestry/**/*.yml are placed into that JSON without any sanitisation. An attacker who controls a Forestry-style project can therefore inject arbitrary JavaScript into the generated tina/templates.{ts,js} file. The injected code is written at module top level, so it executes the moment the developer runs tinacms dev or tinacms build, with the developer's privileges. This issue has been fixed in version 2.4.3.
A remote code execution vulnerability has been identified in @tinacms/cli versions prior to 2.4.3. This issue arises in the Forestry-to-Tina migration command, where the internal helper addVariablesToCode fails to properly sanitize user-supplied values before they are processed. Specifically, values matching the marker '__TINA_INTERNAL__:::(.*?):::' in the collection JSON can be exploited to inject arbitrary JavaScript. An attacker controlling a Forestry project can execute this injected code with the developer's privileges as soon as they run 'tinacms dev' or 'tinacms build'.
Users can update to @tinacms/cli version 2.4.3 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 1, 2026CISA-ADP
Assessed Jul 2, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/tinacms/tinacms/security/advisories/GHSA-4936-9hrh-qqpw | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/tinacms/tinacms/security/advisories/GHSA-4936-9hrh-qqpw | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-94 | Improper Control of Generation of Code ('Code Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| TinaCMS CLI | <= 2.4.3 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 2, 2026 | CVE Modified | CISA-ADP |
| Jul 1, 2026 | New CVE Received | [email protected] |