CVE-2026-108260 (GCVE-0-2026-108260)
Vulnerability from cvelistv5
Published
2026-10-09 20:40
Modified
2026-10-13 15:17
Severity ?
VLAI Severity ?
EPSS score ?
CWE
Summary
Tina is a headless content management system. Prior to 0.2.1, the tina-markdown element in packages/@tinacms/web-components/src/tina-markdown.js assigns a rich-text node.url value directly to an anchor href without validating the URL scheme. A content author can store a link using a script-capable scheme, and a visitor who clicks the rendered link executes attacker-controlled script in the site's origin. The script can access same-origin application data and, when the visitor is an editor or administrator, may expose credentials stored by the TinaCMS admin on that origin. This issue is fixed in version 0.2.1.
References
| URL | Tags | |||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| tinacms | tinacms |
Version: < 3.14.0 |
|||||||
|
|||||||||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-108260",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-13T15:17:02.736533Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T15:17:14.297Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/tinacms/tinacms/security/advisories/GHSA-c42q-qvc3-j6vg"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "tinacms",
"vendor": "tinacms",
"versions": [
{
"status": "affected",
"version": "\u003c 3.14.0"
}
]
},
{
"product": "web-components",
"vendor": "@tinacms",
"versions": [
{
"status": "affected",
"version": "\u003c 0.2.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Tina is a headless content management system. Prior to 0.2.1, the tina-markdown element in packages/@tinacms/web-components/src/tina-markdown.js assigns a rich-text node.url value directly to an anchor href without validating the URL scheme. A content author can store a link using a script-capable scheme, and a visitor who clicks the rendered link executes attacker-controlled script in the site\u0027s origin. The script can access same-origin application data and, when the visitor is an editor or administrator, may expose credentials stored by the TinaCMS admin on that origin. This issue is fixed in version 0.2.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-83",
"description": "CWE-83: Improper Neutralization of Script in Attributes in a Web Page",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-09T20:40:37.228Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/tinacms/tinacms/security/advisories/GHSA-c42q-qvc3-j6vg",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/tinacms/tinacms/security/advisories/GHSA-c42q-qvc3-j6vg"
},
{
"name": "https://github.com/tinacms/tinacms/pull/7523",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/tinacms/tinacms/pull/7523"
},
{
"name": "https://github.com/tinacms/tinacms/commit/5295e077f0d279c35686a0e481a15e33a4877e3b",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/tinacms/tinacms/commit/5295e077f0d279c35686a0e481a15e33a4877e3b"
},
{
"name": "https://github.com/tinacms/tinacms/releases/tag/@tinacms/web-components@0.2.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/tinacms/tinacms/releases/tag/@tinacms/web-components@0.2.1"
}
],
"source": {
"advisory": "GHSA-c42q-qvc3-j6vg",
"discovery": "UNKNOWN"
},
"title": "@tinacms/web-components: `tina-markdown` writes rich-text link URLs into `href` without scheme validation, allowing stored XSS"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-108260",
"datePublished": "2026-10-09T20:40:37.228Z",
"dateReserved": "2026-10-09T17:33:15.409Z",
"dateUpdated": "2026-10-13T15:17:14.297Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-108260\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-10-13T15:17:02.736533Z\"}}}], \"references\": [{\"url\": \"https://github.com/tinacms/tinacms/security/advisories/GHSA-c42q-qvc3-j6vg\", \"tags\": [\"exploit\"]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-10-13T15:16:46.937Z\"}}], \"cna\": {\"title\": \"@tinacms/web-components: `tina-markdown` writes rich-text link URLs into `href` without scheme validation, allowing stored XSS\", \"source\": {\"advisory\": \"GHSA-c42q-qvc3-j6vg\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 7.6, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N\", \"integrityImpact\": \"LOW\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"vendor\": \"tinacms\", \"product\": \"tinacms\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 3.14.0\"}]}, {\"vendor\": \"@tinacms\", \"product\": \"web-components\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 0.2.1\"}]}], \"references\": [{\"url\": \"https://github.com/tinacms/tinacms/security/advisories/GHSA-c42q-qvc3-j6vg\", \"name\": \"https://github.com/tinacms/tinacms/security/advisories/GHSA-c42q-qvc3-j6vg\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/tinacms/tinacms/pull/7523\", \"name\": \"https://github.com/tinacms/tinacms/pull/7523\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/tinacms/tinacms/commit/5295e077f0d279c35686a0e481a15e33a4877e3b\", \"name\": \"https://github.com/tinacms/tinacms/commit/5295e077f0d279c35686a0e481a15e33a4877e3b\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/tinacms/tinacms/releases/tag/@tinacms/web-components@0.2.1\", \"name\": \"https://github.com/tinacms/tinacms/releases/tag/@tinacms/web-components@0.2.1\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Tina is a headless content management system. Prior to 0.2.1, the tina-markdown element in packages/@tinacms/web-components/src/tina-markdown.js assigns a rich-text node.url value directly to an anchor href without validating the URL scheme. A content author can store a link using a script-capable scheme, and a visitor who clicks the rendered link executes attacker-controlled script in the site\u0027s origin. The script can access same-origin application data and, when the visitor is an editor or administrator, may expose credentials stored by the TinaCMS admin on that origin. This issue is fixed in version 0.2.1.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-79\", \"description\": \"CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)\"}]}, {\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-83\", \"description\": \"CWE-83: Improper Neutralization of Script in Attributes in a Web Page\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-10-09T20:40:37.228Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2026-108260\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-10-13T15:17:14.297Z\", \"dateReserved\": \"2026-10-09T17:33:15.409Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-10-09T20:40:37.228Z\", \"assignerShortName\": \"GitHub_M\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…