https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 01:52:18 +0000 https://cve.radiocsirt.org/vuln/cve-2026-54074 <p><strong>Affected:</strong> tinacms</p> <p>Tina is a headless content management system. @tinacms/cli versions prior to 2.4.3 contain a Remote Code Execution vulnerability in the Forestry-to-Tina migration command. The internal helper addVariablesToCode unquotes any value matching the marker &#34;__TINA_INTERNAL__:::(.*?):::&#34; inside the stringified collection JSON. User-supplied label and name fields from .forestry/**/*.yml are placed into that JSON without any sanitisation. An attacker who controls a Forestry-style project can therefore inject arbitrary JavaScript into the generated tina/templates.{ts,js} file. The injected code is written at module top level, so it executes the moment the developer runs tinacms dev or tinacms build, with the developer&#39;s privileges. This issue has been fixed in version 2.4.3.</p> <p><strong>Affected:</strong> tinacms</p> <p>Tina is a headless content management system. @tinacms/cli versions prior to 2.4.3 contain a Remote Code Execution vulnerability in the Forestry-to-Tina migration command. The internal helper addVariablesToCode unquotes any value matching the marker &#34;__TINA_INTERNAL__:::(.*?):::&#34; inside the stringified collection JSON. User-supplied label and name fields from .forestry/**/*.yml are placed into that JSON without any sanitisation. An attacker who controls a Forestry-style project can therefore inject arbitrary JavaScript into the generated tina/templates.{ts,js} file. The injected code is written at module top level, so it executes the moment the developer runs tinacms dev or tinacms build, with the developer&#39;s privileges. This issue has been fixed in version 2.4.3.</p> https://cve.radiocsirt.org/vuln/cve-2026-54074