npmPackage

tinacms

5 known vulnerabilities (1 critical, 3 high, 1 medium), with the versions each affects and the releases that fix them.

Latest release: 3.15.1 (Nov 1, 2026): no advisory affects it
Newest unaffected release: 3.15.1 (Nov 1, 2026), the latest release
Advisories: 5 · 1 critical, 3 high, 1 medium

Weekly downloads: 69.6K
Releases: 500+ since 3.7.4 (Apr 27, 2026)
Registry: npm
Releases read: Nov 8, 2026

Version timeline

CVE-2026-108261
Affects 0.0.0-0509095-20260525122024 to 3.13.0 (3.14.0 is outside it)
CVE-2026-55660
Affects 0.0.0-0509095-20260525122024 to 3.9.2 (3.9.3 is outside it)
CVE-2026-55661
Affects 0.0.0-0509095-20260525122024 to 3.9.2 (3.9.3 is outside it)
CVE-2026-28791
Affects 0.0.0-0509095-20260525122024 to 0.0.0-ffbb4fa-20260624122203 (3.7.4 is outside it)
CVE-2025-68278
Affects 0.0.0-0509095-20260525122024 to 0.0.0-ffbb4fa-20260624122203 (3.7.4 is outside it)

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects. Older releases aren't stored, so the earliest spans may start sooner.

Advisories 5

CVE-2026-108261Critical 9.3
TinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragment
Affected: fixed in 3.14.0.
Fixed in 3.14.0 (released Sep 14, 2026, 25 days before disclosure).
The latest release, 3.15.1, is not affected.
69% of tinacms downloads last week were affected versions (62.4K).
CVE-2026-55660High 7.6
TinaCMS: Cross-origin postMessage handlers and rich-text URL-sanitization bypass enable stored XSS and session takeover
Affected: fixed in 3.9.3.
Fixed in 3.9.3 (released Jun 15, 2026, 16 days before disclosure).
The latest release, 3.15.1, is not affected.
56% of tinacms downloads last week were affected versions (50.7K).
CVE-2026-55661Medium 4.8
TinaCMS rich-text (slatejson) rendering does not sanitize link/image URLs, allowing stored XSS via dangerous URL schemes
Affected: fixed in 3.9.3.
Fixed in 3.9.3 (released Jun 15, 2026, 16 days before disclosure).
The latest release, 3.15.1, is not affected.
56% of tinacms downloads last week were affected versions (50.7K).
CVE-2026-28791High 7.4
Path Traversal in Media Upload Handle in Tina
Affected: fixed in 2.1.7.
Fixed in 3.7.4 (released Apr 27, 2026, 46 days after disclosure, the advisory names 2.1.7, which was never published).
The latest release, 3.15.1, is not affected.
38% of tinacms downloads last week were affected versions (34.4K).
CVE-2025-68278High 7.3
tinacms vulnerable to arbitrary code execution
Affected: fixed in 3.1.1.
Fixed in 3.7.4 (released Apr 27, 2026, 130 days after disclosure, the advisory names 3.1.1, which was never published).
The latest release, 3.15.1, is not affected.
51% of tinacms downloads last week were affected versions (45.8K).