critical vulnerability

TinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragment

Fix availableCritical · CVSS 9.3EPSS 0.16%

Published Oct 9, 2026 · updated Oct 9, 2026

What to do

Upgrade to a fixed version: tinacms 3.14.0, @tinacms/app 2.5.14.
Redeploy and restart long-running processes so they load the fixed code.

Affected packages

npmtinacms

Vulnerable versions: <= 3.13.0
Fixed in: 3.14.0

Check your project: npm ls tinacms --all

Is tinacms@3.14.0 safe to install? See the upgrade verdict →

npm@tinacms/app

Vulnerable versions: <= 2.5.13
Fixed in: 2.5.14

Check your project: npm ls @tinacms/app --all

Is @tinacms/app@2.5.14 safe to install? See the upgrade verdict →

Sources

GitHub Advisory GHSA-x34j-47hf-4xg7
NVD CVE-2026-108261

CWE-346 Origin Validation Error · CWE-441 Unintended Proxy or Intermediary ('Confused Deputy') · CWE-601 URL Redirection to Untrusted Site ('Open Redirect')

← All critical vulnerabilities