npmPackage

@tinacms/cli

9 known vulnerabilities (1 critical, 6 high, 2 medium), with the versions each affects and the releases that fix them.

Latest release: 4.0.4 (Oct 27, 2026): no advisory affects it
Newest unaffected release: 4.0.4 (Oct 27, 2026), the latest release
Advisories: 9 · 1 critical, 6 high, 2 medium

Weekly downloads: 72.1K
Dependents: 0
Releases: 500+ since 2.2.3 (Apr 21, 2026)
Registry: npm
Releases read: Nov 8, 2026

Version timeline

CVE-2026-108259
Affects 0.0.0-0509095-20260525122024 to 2.7.0 (3.0.0 is outside it)
CVE-2026-63123
Affects 0.0.0-0509095-20260525122024 to 2.5.1 (2.5.2 is outside it)
CVE-2026-54074
Affects 0.0.0-0509095-20260525122024 to 2.4.2 (2.4.3 is outside it)
CVE-2026-29066
Affects 0.0.0-0509095-20260525122024 to 0.0.0-ffbb4fa-20260624122203 (2.2.3 is outside it)
CVE-2026-28793
Affects 0.0.0-0509095-20260525122024 to 0.0.0-ffbb4fa-20260624122203 (2.2.3 is outside it)
CVE-2026-28792
Affects 0.0.0-0509095-20260525122024 to 0.0.0-ffbb4fa-20260624122203 (2.2.3 is outside it)
CVE-2025-68278
Affects 0.0.0-0509095-20260525122024 to 0.0.0-ffbb4fa-20260624122203 (2.2.3 is outside it)
CVE-2024-45391
Affects 0.0.0-0509095-20260525122024 to 0.0.0-ffbb4fa-20260624122203 (2.2.3 is outside it)
CVE-2023-25164
No published release is affected
No published release is affected

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects. Older releases aren't stored, so the earliest spans may start sooner.

Advisories 9

CVE-2026-108259High 8.2
Tina: Code injection via unescaped Git branch name in generated client source
Affected: fixed in 3.0.0.
Fixed in 3.0.0 (released Sep 14, 2026, 25 days before disclosure).
The latest release, 4.0.4, is not affected.
78% of @tinacms/cli downloads last week were affected versions (75K).
CVE-2026-63123Medium 6.5
Tina: Cross-origin `POST /media/upload/*` requests can write arbitrary files into the Tina dev server media root
Affected: fixed in 2.5.2.
Fixed in 2.5.2 (released Jul 1, 2026, 49 days before disclosure).
The latest release, 4.0.4, is not affected.
68% of @tinacms/cli downloads last week were affected versions (64.8K).
CVE-2026-54074High 7.8
@tinacms/cli: Remote Code Execution via Forestry migration — unsanitised __TINA_INTERNAL__ marker in user-controlled YAML labels
Affected: fixed in 2.4.3.
Fixed in 2.4.3 (released Jun 3, 2026, 28 days before disclosure).
The latest release, 4.0.4, is not affected.
64% of @tinacms/cli downloads last week were affected versions (61.2K).
CVE-2026-29066Medium 6.2
Arbitrary File Read via Disabled Vite Filesystem Restriction in TinaCMS CLI
Affected: fixed in 2.1.8.
Fixed in 2.2.3 (released Apr 21, 2026, 40 days after disclosure, the advisory names 2.1.8, which was never published).
The latest release, 4.0.4, is not affected.
61% of @tinacms/cli downloads last week were affected versions (58K).
CVE-2026-28793High 8.4
Path Traversal Leading to Arbitrary File Read, Write and Delete in TinaCMS
Affected: fixed in 2.1.8.
Fixed in 2.2.3 (released Apr 21, 2026, 40 days after disclosure, the advisory names 2.1.8, which was never published).
The latest release, 4.0.4, is not affected.
61% of @tinacms/cli downloads last week were affected versions (58K).
CVE-2026-28792Critical 9.7
Cross-Origin File Exfiltration via CORS Misconfiguration + Path Traversal in TinaCMS
Affected: fixed in 2.1.8.
Fixed in 2.2.3 (released Apr 21, 2026, 40 days after disclosure, the advisory names 2.1.8, which was never published).
The latest release, 4.0.4, is not affected.
61% of @tinacms/cli downloads last week were affected versions (58K).
CVE-2025-68278High 7.3
tinacms vulnerable to arbitrary code execution
Affected: fixed in 2.0.4.
Fixed in 2.2.3 (released Apr 21, 2026, 124 days after disclosure, the advisory names 2.0.4, which was never published).
The latest release, 4.0.4, is not affected.
60% of @tinacms/cli downloads last week were affected versions (57.2K).
CVE-2024-45391High 7.5
Tina search token leak via lock file in TinaCMS
Affected: fixed in 1.6.2.
Fixed in 2.2.3 (released Apr 21, 2026, 595 days after disclosure, the advisory names 1.6.2, which was never published).
The latest release, 4.0.4, is not affected.
49% of @tinacms/cli downloads last week were affected versions (47K).
CVE-2023-25164High 8.6
Sensitive Information leak via Script File in TinaCMS
Affected: from 1.0.0, fixed in 1.0.9.
Fixed in 2.2.3 (released Apr 21, 2026, 1168 days after disclosure, the advisory names 1.0.9, which was never published).
The latest release, 4.0.4, is not affected.
0.2% of @tinacms/cli downloads last week were affected versions (203).