# @tinacms/cli (npm) vulnerabilities 9 known vulnerabilities (1 critical, 6 high, 2 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 4.0.4 (Oct 27, 2026): no advisory affects it - Newest unaffected release: 4.0.4 (Oct 27, 2026), the latest release - Weekly downloads: 72.1K - Dependents: 0 - Releases: 500+ since 2.2.3 (Apr 21, 2026) - Registry: https://www.npmjs.com/package/@tinacms/cli - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-108259: 0.0.0-0509095-20260525122024 to 2.7.0 (3.0.0 is outside it) - CVE-2026-63123: 0.0.0-0509095-20260525122024 to 2.5.1 (2.5.2 is outside it) - CVE-2026-54074: 0.0.0-0509095-20260525122024 to 2.4.2 (2.4.3 is outside it) - CVE-2026-29066: 0.0.0-0509095-20260525122024 to 0.0.0-ffbb4fa-20260624122203 (2.2.3 is outside it) - CVE-2026-28793: 0.0.0-0509095-20260525122024 to 0.0.0-ffbb4fa-20260624122203 (2.2.3 is outside it) - CVE-2026-28792: 0.0.0-0509095-20260525122024 to 0.0.0-ffbb4fa-20260624122203 (2.2.3 is outside it) - CVE-2025-68278: 0.0.0-0509095-20260525122024 to 0.0.0-ffbb4fa-20260624122203 (2.2.3 is outside it) - CVE-2024-45391: 0.0.0-0509095-20260525122024 to 0.0.0-ffbb4fa-20260624122203 (2.2.3 is outside it) - CVE-2023-25164: no published release is affected Older releases aren't stored, so the earliest spans may start sooner. ## Advisories (9) ### [CVE-2026-108259](https://cve.now/CVE-2026-108259): Tina: Code injection via unescaped Git branch name in generated client source - Severity: High 8.2 - Published: Oct 9, 2026 - Affected: fixed in 3.0.0. - Fixed in 3.0.0 (released Sep 14, 2026, 25 days before disclosure). - The latest release, 4.0.4, is not affected. - 78% of @tinacms/cli downloads last week were affected versions (75K). ### [CVE-2026-63123](https://cve.now/CVE-2026-63123): Tina: Cross-origin \`POST /media/upload/\*\` requests can write arbitrary files into the Tina dev server media root - Severity: Medium 6.5 - Published: Aug 19, 2026 - Affected: fixed in 2.5.2. - Fixed in 2.5.2 (released Jul 1, 2026, 49 days before disclosure). - The latest release, 4.0.4, is not affected. - 68% of @tinacms/cli downloads last week were affected versions (64.8K). ### [CVE-2026-54074](https://cve.now/CVE-2026-54074): @tinacms/cli: Remote Code Execution via Forestry migration — unsanitised \_\_TINA\_INTERNAL\_\_ marker in user-controlled YAML labels - Severity: High 7.8 - Published: Jul 1, 2026 - Affected: fixed in 2.4.3. - Fixed in 2.4.3 (released Jun 3, 2026, 28 days before disclosure). - The latest release, 4.0.4, is not affected. - 64% of @tinacms/cli downloads last week were affected versions (61.2K). ### [CVE-2026-29066](https://cve.now/CVE-2026-29066): Arbitrary File Read via Disabled Vite Filesystem Restriction in TinaCMS CLI - Severity: Medium 6.2 - Published: Mar 12, 2026 - Affected: fixed in 2.1.8. - Fixed in 2.2.3 (released Apr 21, 2026, 40 days after disclosure, the advisory names 2.1.8, which was never published). - The latest release, 4.0.4, is not affected. - 61% of @tinacms/cli downloads last week were affected versions (58K). ### [CVE-2026-28793](https://cve.now/CVE-2026-28793): Path Traversal Leading to Arbitrary File Read, Write and Delete in TinaCMS - Severity: High 8.4 - Published: Mar 12, 2026 - Affected: fixed in 2.1.8. - Fixed in 2.2.3 (released Apr 21, 2026, 40 days after disclosure, the advisory names 2.1.8, which was never published). - The latest release, 4.0.4, is not affected. - 61% of @tinacms/cli downloads last week were affected versions (58K). ### [CVE-2026-28792](https://cve.now/CVE-2026-28792): Cross-Origin File Exfiltration via CORS Misconfiguration + Path Traversal in TinaCMS - Severity: Critical 9.7 - Published: Mar 12, 2026 - Affected: fixed in 2.1.8. - Fixed in 2.2.3 (released Apr 21, 2026, 40 days after disclosure, the advisory names 2.1.8, which was never published). - The latest release, 4.0.4, is not affected. - 61% of @tinacms/cli downloads last week were affected versions (58K). ### [CVE-2025-68278](https://cve.now/CVE-2025-68278): tinacms vulnerable to arbitrary code execution - Severity: High 7.3 - Published: Dec 18, 2025 - Affected: fixed in 2.0.4. - Fixed in 2.2.3 (released Apr 21, 2026, 124 days after disclosure, the advisory names 2.0.4, which was never published). - The latest release, 4.0.4, is not affected. - 60% of @tinacms/cli downloads last week were affected versions (57.2K). ### [CVE-2024-45391](https://cve.now/CVE-2024-45391): Tina search token leak via lock file in TinaCMS - Severity: High 7.5 - Published: Sep 3, 2024 - Affected: fixed in 1.6.2. - Fixed in 2.2.3 (released Apr 21, 2026, 595 days after disclosure, the advisory names 1.6.2, which was never published). - The latest release, 4.0.4, is not affected. - 49% of @tinacms/cli downloads last week were affected versions (47K). ### [CVE-2023-25164](https://cve.now/CVE-2023-25164): Sensitive Information leak via Script File in TinaCMS - Severity: High 8.6 - Published: Feb 8, 2023 - Affected: from 1.0.0, fixed in 1.0.9. - Fixed in 2.2.3 (released Apr 21, 2026, 1168 days after disclosure, the advisory names 1.0.9, which was never published). - The latest release, 4.0.4, is not affected. - 0.2% of @tinacms/cli downloads last week were affected versions (203). --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/npm/@tinacms/cli Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.