@tinacms/app vulnerabilities
CVEs whose affected-version data names the @tinacms/app package (npm). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-108261Critical· 9.3PoCTina is a headless content management system
Tina is a headless content management system. Prior to tinacms 3.14.0 and @tinacms/app 2.5.14, the /~/* admin preview route in packages/tinacms/src/admin/index.tsx can turn an attacker-controlled hash-router splat into an off-origin ifra…
▾ Abyssaltinacms · tinacmsEPSS 0.20%via NVD
CVE-2026-55660HighTinaCMS: Cross-origin postMessage handlers and rich-text URL-sanitization bypass enable stored XSS and session takeover
TinaCMS: Cross-origin postMessage handlers and rich-text URL-sanitization bypass enable stored XSS and session takeover
▾ Twilighttinacms · tinacmsEPSS 0.28%via GHSA