@tinacms/cli

npm · Package

9 reports

Vulnerability alerts

Report	Product	Ecosystem	Severity	Fix status	Last updated
Tina: Code injection via unescaped Git branch name in generated client sourceCVE-2026-108259 · GHSA-PWHX-CVV3-QJ5C	@tinacms/cli	npm	High	Fix reported	2026-10-10
@tinacms/cli: Remote Code Execution in @tinacms/cli via Forestry migration — unsanitised __TINA_INTERNAL__ marker in user-controlled YAML labelsCVE-2026-54074 · GHSA-4936-9HRH-QQPW	@tinacms/cli	npm	High	Fix reported	2026-09-10
Sensitive Information leak via Script File in TinaCMSCVE-2023-25164 · GHSA-PC2Q-JCXQ-RJRR	@tinacms/cli	npm	High	Fix reported	2026-09-10
Tina: Cross-origin `POST /media/upload/*` requests can write arbitrary files into the Tina dev server media rootCVE-2026-63123 · GHSA-RGR9-R7MJ-MF6X	@tinacms/cli	npm	Medium	Fix reported	2026-08-21
TinaCMS CLI Dev Server Vulnerable to Cross-Origin File Exfiltration via CORS Misconfiguration + Path Traversal in TinaCMSCVE-2026-28792 · GHSA-8PW3-9M7F-Q734	@tinacms/cli	npm	Critical	Fix reported	2026-03-14
TinaCMS CLI has Arbitrary File Read via Disabled Vite Filesystem RestrictionCVE-2026-29066 · GHSA-M48G-4WR2-J2H6	@tinacms/cli	npm	Medium	Fix reported	2026-03-14
TinaCMS Vulnerable to Path Traversal Leading to Arbitrary File Read, Write and DeleteCVE-2026-28793 · GHSA-2F24-MG4X-534Q	@tinacms/cli	npm	High	Fix reported	2026-03-14
tinacms is vulnerable to arbitrary code executionCVE-2025-68278 · GHSA-529F-9QWM-9628	@tinacms/cli @tinacms/graphql	npm	High	Fix reported	2025-12-19
Tina search token leak via lock file in TinaCMSCVE-2024-45391 · GHSA-4QRM-9H4R-V2FX	@tinacms/cli	npm	High	Fix reported	2024-09-13