CVE-2026-108260

HIGH 7.6

@tinacms/web-components: `tina-markdown` writes rich-text link URLs into `href` without scheme validation, allowing stored XSS

CVSS Score

7.6

EPSS Score

0.0%

EPSS Percentile

0th

Tina is a headless content management system. Prior to 0.2.1, the tina-markdown element in packages/@tinacms/web-components/src/tina-markdown.js assigns a rich-text node.url value directly to an anchor href without validating the URL scheme. A content author can store a link using a script-capable scheme, and a visitor who clicks the rendered link executes attacker-controlled script in the site's origin. The script can access same-origin application data and, when the visitor is an editor or administrator, may expose credentials stored by the TinaCMS admin on that origin. This issue is fixed in version 0.2.1.

CWE	CWE-79 CWE-83
Vendor	tinacms
Product	tinacms
Published	Oct 9, 2026

Stay Ahead of the Next One

Get instant alerts for tinacms tinacms

Be the first to know when new high vulnerabilities affecting tinacms tinacms are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

Low

Availability

None

Affected Versions

tinacms / tinacms

< 3.14.0

@tinacms / web-components

< 0.2.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/tinacms/tinacms/security/advisories/GHSA-c42q-qvc3-j6vg github.com: https://github.com/tinacms/tinacms/pull/7523 github.com: https://github.com/tinacms/tinacms/commit/5295e077f0d279c35686a0e481a15e33a4877e3b github.com: https://github.com/tinacms/tinacms/releases/tag/@tinacms/[email protected]