CVE-2026-55660 Details
Description
Tina is a headless content management system. In versions prior to @tinacms/app 2.5.6 and tinacms 3.9.3, cross-origin postMessage handlers and a rich-text URL-sanitization bypass enable stored XSS and session takeover. The library registers window message listeners — the useTina overlay handler, the OAuth authentication popup handler, and the admin↔preview iframe GraphQL reducer — that act on event.data without verifying event.origin or event.source and post messages using non-specific target origins, while insufficient URL sanitization in rich-text content allows malicious URLs to persist and execute. A page the victim visits (or a window in an opener/iframe relationship with a Tina admin) can forge messages to drive the editor, inject preview content, or observe/forge the OAuth popup channel to take over an authenticated editing session. This issue has been fixed in versions @tinacms/app 2.5.6 and tinacms 3.9.3.
A vulnerability in TinaCMS's message handling can lead to stored cross-site scripting (XSS) and session takeover. This issue affects versions of @tinacms/app prior to 2.5.6 and tinacms prior to 3.9.3. The vulnerability arises because TinaCMS registers window message listeners that process event data without verifying the origin or source of the messages. This lack of validation allows a malicious page to forge messages that can manipulate the TinaCMS editor, inject content into the preview, or hijack the OAuth authentication process to take over an editing session. Additionally, a rich-text URL-sanitization bypass allows harmful URLs to be stored and executed.
Users can upgrade to @tinacms/app version 2.5.6 or tinacms version 3.9.3 to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 1, 2026CISA-ADP
Assessed Jul 2, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/tinacms/tinacms/pull/7056 | [email protected] | Issue TrackingVendor |
| https://github.com/tinacms/tinacms/security/advisories/GHSA-g5qx-h5f3-mp2f | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-346 | Origin Validation Error | [email protected] |
| CWE-601 | URL Redirection to Untrusted Site ('Open Redirect') | [email protected] |
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
| CWE-940 | Improper Verification of Source of a Communication Channel | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| TinaCMS | < 3.9.3 (semver) |
CPE
Remediation
| |
| TinaCMS App | < 2.5.6 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 2, 2026 | CVE Modified | CISA-ADP |
| Jul 1, 2026 | New CVE Received | [email protected] |