p PatchFirst

CVE-2025-68278

CVE-2025-68278 · tinacms vulnerable to arbitrary code execution

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Tina is a headless content management system. In tinacms prior to version 3.1.1, tinacms uses the gray-matter package in an insecure way allowing attackers that can control the content of the processed markdown files, e.g., blog posts, to execute arbitrary code. tinacms version 3.1.1, @tinacms/cli version 2.0.4, and @tinacms/graphql version 2.0.3 contain a fix for the issue.

CVSS 7.3 · High · EPSS 0.5% · Fix available

Published
Updated

Stack: node

Affected products and versions

  • tinacms

    Versions
    • tinacms < 3.1.1: Affected
    • @tinacms/cli < 2.0.4: Affected
    • @tinacms/graphql < 2.0.3: Affected

    No fix published

  • tinacms npm

    Affected ranges
    • SEMVER: < 3.1.1

    Update to 3.1.1

  • @tinacms/cli npm

    Affected ranges
    • SEMVER: < 2.0.4

    Update to 2.0.4

  • @tinacms/graphql npm

    Affected ranges
    • SEMVER: < 2.0.3

    Update to 2.0.3

Original sources

Check your server →