https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 17:26:07 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-275990 EUVD-2026-275990 https://cve.radiocsirt.org/vuln/euvd-2026-275990 https://cve.radiocsirt.org/vuln/fkie_cve-2026-28792 <p>Tina is a headless content management system. Prior to 2.1.8 , the TinaCMS CLI dev server combines a permissive CORS configuration (Access-Control-Allow-Origin: *) with the path traversal vulnerability (previously reported) to enable a browser-based drive-by attack. A remote attacker can enumerate the filesystem, write arbitrary files, and delete arbitrary files on developer&#39;s machines by simply tricking them into visiting a malicious website while tinacms dev is running. This vulnerability is fixed in 2.1.8.</p> <p>Tina is a headless content management system. Prior to 2.1.8 , the TinaCMS CLI dev server combines a permissive CORS configuration (Access-Control-Allow-Origin: *) with the path traversal vulnerability (previously reported) to enable a browser-based drive-by attack. A remote attacker can enumerate the filesystem, write arbitrary files, and delete arbitrary files on developer&#39;s machines by simply tricking them into visiting a malicious website while tinacms dev is running. This vulnerability is fixed in 2.1.8.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-28792 https://cve.radiocsirt.org/vuln/ghsa-8pw3-9m7f-q734 <p><strong>Affected:</strong> npm: @tinacms/cli</p> <p>## Summary The TinaCMS CLI dev server combines a permissive CORS configuration (Access-Control-Allow-Origin: *) with the path traversal vulnerability (previously reported) to enable a browser-based drive-by attack. A remote attacker can enumerate the filesystem, write arbitrary files, and delete arbitrary files on developer&#39;s machines by simply tricking them into visiting a malicious website while tinacms dev is running.</p> <p>## Details The TinaCMS dev server sets permissive CORS headers that allow **any origin** to make cross-origin requests:</p> <p>- packages/@tinacms/cli/src/server/server.ts: ``` app.use(cors()); ```</p> <p>- packages/@tinacms/cli/src/next/vite/plugins.ts: ``` server.middlewares.use(cors()); ``` When combined with the path traversal vulnerability, this creates a complete attack chain. ## Attack Scenario</p> <p>### Prerequisites 1. Developer runs `tinacms dev` (default port 4001) 2. Developer visits attacker&#39;s website while TinaCMS is running</p> <p>**No other conditions required** - the dev server doesn&#39;t need to be: - Exposed to the internet - Bound to 0.0.0.0 - Accessible outside localhost</p> <p>### Attack Flow 1. Developer starts TinaCMS: `tinacms dev` 2. Developer browses the web (checking email, social media, etc.) 3. Developer unknowingly visits attacker-controlled page (malicious ad, compromised site, etc.) 4. Attacker&#39;s JavaScript exploits CORS + path traversal to read sensitive files 5. Files are exfiltrated to attacker&#39;s server</p> <p>## PoC ### Attacker&#39;s Malicious Website (…</p> <p><strong>Affected:</strong> npm: @tinacms/cli</p> <p>## Summary The TinaCMS CLI dev server combines a permissive CORS configuration (Access-Control-Allow-Origin: *) with the path traversal vulnerability (previously reported) to enable a browser-based drive-by attack. A remote attacker can enumerate the filesystem, write arbitrary files, and delete arbitrary files on developer&#39;s machines by simply tricking them into visiting a malicious website while tinacms dev is running.</p> <p>## Details The TinaCMS dev server sets permissive CORS headers that allow **any origin** to make cross-origin requests:</p> <p>- packages/@tinacms/cli/src/server/server.ts: ``` app.use(cors()); ```</p> <p>- packages/@tinacms/cli/src/next/vite/plugins.ts: ``` server.middlewares.use(cors()); ``` When combined with the path traversal vulnerability, this creates a complete attack chain. ## Attack Scenario</p> <p>### Prerequisites 1. Developer runs `tinacms dev` (default port 4001) 2. Developer visits attacker&#39;s website while TinaCMS is running</p> <p>**No other conditions required** - the dev server doesn&#39;t need to be: - Exposed to the internet - Bound to 0.0.0.0 - Accessible outside localhost</p> <p>### Attack Flow 1. Developer starts TinaCMS: `tinacms dev` 2. Developer browses the web (checking email, social media, etc.) 3. Developer unknowingly visits attacker-controlled page (malicious ad, compromised site, etc.) 4. Attacker&#39;s JavaScript exploits CORS + path traversal to read sensitive files 5. Files are exfiltrated to attacker&#39;s server</p> <p>## PoC ### Attacker&#39;s Malicious Website (…</p> https://cve.radiocsirt.org/vuln/ghsa-8pw3-9m7f-q734