- Latest release
- Not known: cve.now hasn't read this package's releases
- Newest unaffected release
- Not known without release data
- Advisories
- 5 · 4 high, 1 medium
- Weekly downloads
- 64.4K
- Dependents
- 7
- Registry
- npm
Advisories 5
- CVE-2026-34603High 7.1
@tinacms/graphql's Media Endpoints Can Escape the Media Root via Symlinks or Junctions
Affected: fixed in 2.2.2.
- CVE-2026-34604High 7.1
@tinacms/graphql's `FilesystemBridge` Path Validation Can Be Bypassed via Symlinks or Junctions
Affected: fixed in 2.2.2.
- CVE-2026-33949High 8.1
@tinacms/graphql has Path Traversal that leads to overwrite of arbitrary files
Affected: fixed in 2.2.2.
- CVE-2026-24125Medium 6.3
Path Traversal in @tinacms/graphql
Affected: fixed in 2.1.2.
- CVE-2025-68278High 7.3
tinacms vulnerable to arbitrary code execution
Affected: fixed in 2.0.3.