---
id: CVE-2026-55660
title: >-
  TinaCMS: Cross-origin postMessage handlers and rich-text URL-sanitization
  bypass enable stored XSS and session takeover
summary: >-
  TinaCMS: Cross-origin postMessage handlers and rich-text URL-sanitization
  bypass enable stored XSS and session takeover
severity: high
cwe:
  - CWE-79
  - CWE-346
  - CWE-601
  - CWE-940
vendor: tinacms
product: tinacms
ecosystem: npm
affected:
  - tinacms < 3.9.3
  - '@tinacms/app < 2.5.6'
patched:
  - tinacms 3.9.3
  - '@tinacms/app 2.5.6'
published: '2026-06-19'
updated: '2026-06-19'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-g5qx-h5f3-mp2f'
references:
  - url: 'https://github.com/tinacms/tinacms/security/advisories/GHSA-g5qx-h5f3-mp2f'
  - url: 'https://github.com/tinacms/tinacms/pull/7056'
  - url: 'https://github.com/advisories/GHSA-g5qx-h5f3-mp2f'
tags:
  - ghsa
  - npm
ingestedAt: '2026-06-22T13:35:24.355Z'
epss: 0.00279
epssPercentile: 0.18144
---

## Overview

TinaCMS registers window message listeners — the useTina overlay handler, the OAuth authentication popup handler, and the admin↔preview iframe GraphQL reducer — that act on event.data without verifying event.origin or event.source, and post messages using non-specific target origins. A page the victim visits (or a window in an opener/iframe relationship with a Tina admin) can forge messages to drive the editor, inject preview content, or observe/forge the OAuth popup channel to take over an authenticated editing session.

Fixed in [#7056](https://github.com/tinacms/tinacms/pull/7056) by allow-listing trusted origins and verifying event.source (isFromAdmin, isFromTrustedPreviewOrigin), and by posting only to explicit target origins (never "*").

Note: the rich-text URL-sanitization issue previously bundled here has been split into its own advisory (GHSA-2vcc-5v34-9jc8) so each vulnerability can receive a distinct CVE.

## Affected packages

- `tinacms < 3.9.3`
- `@tinacms/app < 2.5.6`

## Remediation

Upgrade to a patched release:

- `tinacms 3.9.3`
- `@tinacms/app 2.5.6`