CVE-2026-126774
@tinacms/mdx before 2.4.2 Code Injection via MDX Serializer Rich-Text Values
CVSS Score
8.2
EPSS Score
0.0%
EPSS Percentile
0th
@tinacms/mdx before 2.4.2 contains a code injection vulnerability in its MDX serializer, which writes rich-text values into MDX expressions without escaping them. Authenticated content editors can save crafted values that break out of list field or highlightColor expressions in the stored .mdx file, executing JavaScript in visitors' browsers or on build and server-side rendering hosts.
| CWE | CWE-94 |
| Vendor | tinacms |
| Product | @tinacms/mdx |
| Published | Nov 11, 2026 |
Stay Ahead of the Next One
Get instant alerts for tinacms @tinacms/mdx
Be the first to know when new high vulnerabilities affecting tinacms @tinacms/mdx are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N Attack Vector
Network
Attack Complexity
High
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
None
Affected Versions
tinacms / @tinacms/mdx
0 < 2.4.2
References
github.com: https://github.com/tinacms/tinacms/security/advisories/GHSA-6vw5-w22x-ghxv github.com: https://github.com/tinacms/tinacms/pull/7958 github.com: https://github.com/tinacms/tinacms/commit/19285c6deeee52c380e8b2fdeafedc9530dc0618 github.com: https://github.com/tinacms/tinacms/releases/tag/%40tinacms/mdx%402.4.2 github.com: https://github.com/tinacms/tinacms/blob/%40tinacms/mdx%400.60.3/packages/%40tinacms/mdx/src/stringify/acorn.ts#L81 vulncheck.com: https://www.vulncheck.com/advisories/tinacms-mdx-before-2.4.2-code-injection-via-mdx-serializer-rich-text-values
Credits
Zachariah Mithani (AploSec)