{"id":"CVE-2026-108260","published":"2026-10-09T21:17:04.180","lastModified":"2026-10-13T16:17:12.223","description":"Tina is a headless content management system. Prior to 0.2.1, the tina-markdown element in packages/@tinacms/web-components/src/tina-markdown.js assigns a rich-text node.url value directly to an anchor href without validating the URL scheme. A content author can store a link using a script-capable scheme, and a visitor who clicks the rendered link executes attacker-controlled script in the site's origin. The script can access same-origin application data and, when the visitor is an editor or administrator, may expose credentials stored by the TinaCMS admin on that origin. This issue is fixed in version 0.2.1.","cvssScore":7.6,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N","cwes":["CWE-79","CWE-83"],"vendors":[],"products":[],"references":[{"url":"https://github.com/tinacms/tinacms/commit/5295e077f0d279c35686a0e481a15e33a4877e3b","tags":[]},{"url":"https://github.com/tinacms/tinacms/pull/7523","tags":[]},{"url":"https://github.com/tinacms/tinacms/releases/tag/@tinacms/web-components@0.2.1","tags":[]},{"url":"https://github.com/tinacms/tinacms/security/advisories/GHSA-c42q-qvc3-j6vg","tags":[]},{"url":"https://github.com/tinacms/tinacms/security/advisories/GHSA-c42q-qvc3-j6vg","tags":[]}],"exploitRefs":[{"url":"https://github.com/tinacms/tinacms/commit/5295e077f0d279c35686a0e481a15e33a4877e3b","tags":[]},{"url":"https://github.com/tinacms/tinacms/pull/7523","tags":[]},{"url":"https://github.com/tinacms/tinacms/releases/tag/@tinacms/web-components@0.2.1","tags":[]},{"url":"https://github.com/tinacms/tinacms/security/advisories/GHSA-c42q-qvc3-j6vg","tags":[]},{"url":"https://github.com/tinacms/tinacms/security/advisories/GHSA-c42q-qvc3-j6vg","tags":[]}],"hasPoc":true,"ai":{"summary":"A content management system allows authors to store links with script-capable URL schemes like 'javascript:' or 'data:', which execute attacker code when clicked by visitors. This creates a cross-site scripting vulnerability that can steal credentials from editors and administrators.","exploitability":"Exploitation is moderately easy as it requires only a content author to create a malicious link, but the attack depends on visitor interaction with the rendered page containing the vulnerable link.","blast_radius":"The impact could be significant if editors or administrators visit pages with malicious links, potentially exposing their credentials and allowing further access to the CMS admin interface.","remediation":"Upgrade to version 0.2.1 or later to fix the URL validation issue in the tina-markdown component.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["xss","cms","web"],"model":"garnet-coder","analyzedAt":"2026-10-17T08:59:27.594Z"}}