Skip to main content
cve.nowby Sazabi
← npm
npmPackage

@tinacms/web-components

1 known vulnerability (1 high), with the versions each affects and the releases that fix them.

Latest release
0.2.3 (Oct 19, 2026): no advisory affects it
Newest unaffected release
0.2.3 (Oct 19, 2026), the latest release
Advisories
1 · 1 high
Weekly downloads
225
Dependents
0
Releases
33 since 0.0.0 (Aug 17, 2026)
Registry
npm
Releases read
Nov 8, 2026

Version timeline

  • CVE-2026-108260
    Affects 0.0.0-4061231-20260817055908 to 0.2.0 (0.2.1 is outside it)
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 1

  • @tinacms/web-components: `tina-markdown` writes rich-text link URLs into `href` without scheme validation, allowing stored XSS

    Affected: fixed in 0.2.1.

    Fixed in 0.2.1 (released Sep 14, 2026, 25 days before disclosure).

    The latest release, 0.2.3, is not affected.

    89% of @tinacms/web-components downloads last week were affected versions (173).