CVE-2026-108260
CVE-2026-108260 · @tinacms/web-components: `tina-markdown` writes rich-text link URLs into `href` without scheme validation, allowing stored XSS
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Tina is a headless content management system. Prior to 0.2.1, the tina-markdown element in packages/@tinacms/web-components/src/tina-markdown.js assigns a rich-text node.url value directly to an anchor href without validating the URL scheme. A content author can store a link using a script-capable scheme, and a visitor who clicks the rendered link executes attacker-controlled script in the site's origin. The script can access same-origin application data and, when the visitor is an editor or administrator, may expose credentials stored by the TinaCMS admin on that origin. This issue is fixed in version 0.2.1.
CVSS 7.6 · High · EPSS 0.3% · Fix available
- Published
- Updated
Stack: node
Affected products and versions
tinacms
- Versions
- < 3.14.0: Affected
No fix published
web-components
- Versions
- < 0.2.1: Affected
No fix published
@tinacms/web-components npm
- Affected ranges
- SEMVER: < 0.2.1
Update to 0.2.1
Original sources
- https://github.com/tinacms/tinacms/security/advisories/GHSA-c42q-qvc3-j6vg
- https://github.com/tinacms/tinacms/pull/7523
- https://github.com/tinacms/tinacms/commit/5295e077f0d279c35686a0e481a15e33a4877e3b
- https://github.com/tinacms/tinacms/releases/tag/@tinacms/[email protected]
- https://nvd.nist.gov/vuln/detail/CVE-2026-108260