{"id":"CVE-2026-108261","title":"Tina is a headless content management system","summary":"Tina is a headless content management system. Prior to tinacms 3.14.0 and @tinacms/app 2.5.14, the /~/* admin preview route in packages/tinacms/src/admin/index.tsx can turn an attacker-controlled hash-router splat into an off-origin ifra…","severity":"critical","cvss":9.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","cwe":["CWE-346","CWE-441","CWE-601"],"vendor":"tinacms","product":"tinacms","affected":["tinacms <= 3.13.0","@tinacms/app <= 2.5.13"],"patched":["tinacms 3.14.0","@tinacms/app 2.5.14"],"published":"2026-10-09","updated":"2026-10-09","sourceUpdated":"2026-10-09T21:17:04.347","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-108261","references":[{"url":"https://github.com/tinacms/tinacms/commit/b57dbf4b56201aef15cd92caa49fd12ab96bbecf","label":"security-advisories@github.com"},{"url":"https://github.com/tinacms/tinacms/pull/7522","label":"security-advisories@github.com"},{"url":"https://github.com/tinacms/tinacms/releases/tag/@tinacms/app@2.5.14","label":"security-advisories@github.com"},{"url":"https://github.com/tinacms/tinacms/releases/tag/tinacms@3.14.0","label":"security-advisories@github.com"},{"url":"https://github.com/tinacms/tinacms/security/advisories/GHSA-x34j-47hf-4xg7","label":"security-advisories@github.com"},{"url":"https://github.com/advisories/GHSA-x34j-47hf-4xg7"}],"tags":["nvd","ghsa","npm"],"aliases":["GHSA-x34j-47hf-4xg7"],"ecosystem":"npm","ingestedAt":"2026-10-09T21:12:42.322Z","slug":"CVE-2026-108261","body":"## Overview\n\nTina is a headless content management system. Prior to tinacms 3.14.0 and @tinacms/app 2.5.14, the /~/* admin preview route in packages/tinacms/src/admin/index.tsx can turn an attacker-controlled hash-router splat into an off-origin iframe URL through packages/@tinacms/app/src/preview.tsx, while packages/@tinacms/app/src/lib/preview-origin.ts derives expectedOrigin from that same URL for the GraphQL message channel in packages/@tinacms/app/src/lib/graphql-reducer.ts. An unauthenticated attacker can send a crafted link to a signed-in editor, cause the admin to frame an attacker origin, and have that frame treated as the trusted preview. The attacker-controlled frame can submit GraphQL reads or mutations that the admin executes with the editor credentials, exposing or modifying protected content. This issue is fixed in tinacms 3.14.0 and @tinacms/app 2.5.14.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-108261)\n\nAffected packages:\n\n- `tinacms <= 3.13.0`\n- `@tinacms/app <= 2.5.13`\n\nPatched in:\n\n- `tinacms 3.14.0`\n- `@tinacms/app 2.5.14`\n\nSource: https://github.com/advisories/GHSA-x34j-47hf-4xg7","depth":"midnight","depthScore":51,"depthScoreParts":{"impact":51.2,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}