{"id":"CVE-2026-55660","title":"TinaCMS: Cross-origin postMessage handlers and rich-text URL-sanitization bypass enable stored XSS and session takeover","summary":"TinaCMS: Cross-origin postMessage handlers and rich-text URL-sanitization bypass enable stored XSS and session takeover","severity":"high","cwe":["CWE-79","CWE-346","CWE-601","CWE-940"],"vendor":"tinacms","product":"tinacms","ecosystem":"npm","affected":["tinacms < 3.9.3","@tinacms/app < 2.5.6"],"patched":["tinacms 3.9.3","@tinacms/app 2.5.6"],"published":"2026-06-19","updated":"2026-06-19","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-g5qx-h5f3-mp2f","references":[{"url":"https://github.com/tinacms/tinacms/security/advisories/GHSA-g5qx-h5f3-mp2f"},{"url":"https://github.com/tinacms/tinacms/pull/7056"},{"url":"https://github.com/advisories/GHSA-g5qx-h5f3-mp2f"}],"tags":["ghsa","npm"],"ingestedAt":"2026-06-22T13:35:24.355Z","epss":0.00279,"epssPercentile":0.18066,"slug":"CVE-2026-55660","body":"## Overview\n\nTinaCMS registers window message listeners — the useTina overlay handler, the OAuth authentication popup handler, and the admin↔preview iframe GraphQL reducer — that act on event.data without verifying event.origin or event.source, and post messages using non-specific target origins. A page the victim visits (or a window in an opener/iframe relationship with a Tina admin) can forge messages to drive the editor, inject preview content, or observe/forge the OAuth popup channel to take over an authenticated editing session.\n\nFixed in [#7056](https://github.com/tinacms/tinacms/pull/7056) by allow-listing trusted origins and verifying event.source (isFromAdmin, isFromTrustedPreviewOrigin), and by posting only to explicit target origins (never \"*\").\n\nNote: the rich-text URL-sanitization issue previously bundled here has been split into its own advisory (GHSA-2vcc-5v34-9jc8) so each vulnerability can receive a distinct CVE.\n\n## Affected packages\n\n- `tinacms < 3.9.3`\n- `@tinacms/app < 2.5.6`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `tinacms 3.9.3`\n- `@tinacms/app 2.5.6`","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}