EUVD-2026-385233

fkie_cve-2026-108259

Tina is a headless content management system. Prior to 3.0.0, @tinacms/cli reads Git branch values from VERCEL_GIT_COMMIT_REF, GITHUB_BRANCH, or HEAD, incorporates the raw value into the API URL, and interpolates that URL into JavaScript string literals in packages/@tinacms/cli/src/next/codegen/index.ts and packages/@tinacms/cli/src/next/codegen/codegen/plugin.ts. A crafted Git-valid branch name containing a quote can terminate the generated string and inject an expression that executes when the generated client module is imported during a preview build. The injected code runs with the build process privileges and can read environment credentials, modify deployment artifacts, or make network requests. This issue is fixed in version 3.0.0.

GHSA-pwhx-cvv3-qj5c — Tina: Code injection via unescaped Git branch name in generated client source

Affected: npm: @tinacms/cli

### Summary

`@tinacms/cli` inserts the raw Git branch value into the generated `client.ts` source without escaping or encoding. A Git-valid branch name can close the string literal and inject an arbitrary JavaScript expression that executes when the consumer build imports the generated client module.

### Affected component

- **Source (branch read):** `packages/@tinacms/cli/src/cmds/init/templates/config.ts` lines 155–172 — reads `VERCEL_GIT_COMMIT_REF`, `GITHUB_BRANCH`, or `HEAD` into `config.branch` - **Transform (URL build):** `packages/@tinacms/cli/src/next/codegen/index.ts` lines 219–253 — `_createApiUrl()` concatenates the raw branch into the API URL with no `encodeURIComponent` - **Sink (template):** `packages/@tinacms/cli/src/next/codegen/index.ts` lines 363–381 — `genClient()` interpolates the URL into `url: '${apiURL}'` - **Sibling sink:** `packages/@tinacms/cli/src/next/codegen/codegen/plugin.ts` line 55 — `url: "${apiURL}"` (same pattern, double quotes)

### Root cause

The codegen template at `index.ts:376` uses:

```ts url: '${apiURL}' ```

where `apiURL` contains the raw branch name. No `JSON.stringify`, `encodeURIComponent`, or string-escape function is applied at any point in the pipeline. A single quote in the branch name closes the string literal and allows expression injection.

### Payload

The following is a valid Git branch name (`git check-ref-format` accepts it):

``` x'+(globalThis.__TINA_PROBE='hit')+' ```

### Generated source (sink)

When codeg…

Most recent entries from all

EUVD-2026-385233

fkie_cve-2026-108259

GHSA-pwhx-cvv3-qj5c — Tina: Code injection via unescaped Git branch name in generated client source