tinacms
npm · Package
Vulnerability alerts
Follow| Report | Product | Ecosystem | Severity | Fix status | Last updated |
|---|---|---|---|---|---|
| TinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragment | @tinacms/apptinacms | npm | Critical | Fix reported | |
| TinaCMS rich-text (slatejson) rendering does not sanitize link/image URLs, allowing stored XSS via dangerous URL schemes | @tinacms/mdxtinacms | npm | Medium | Fix reported | |
| TinaCMS: Cross-origin postMessage handlers and rich-text URL-sanitization bypass enable stored XSS and session takeover | @tinacms/apptinacms | npm | High | Fix reported | |
| Tina: Path Traversal in Media Upload Handle | tinacms | npm | High | Fix reported | |
| tinacms is vulnerable to arbitrary code execution | @tinacms/cli@tinacms/graphql | npm | High | Fix reported |