Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.3
CVE-2026-108261: TinCMS admin preview can load attacker-controlled page
CVE-2026-108261 · published today
Summary
The preview feature in TinCMS versions before 3.14.0 (and the @tinacms/app package before 2.5.14) can be tricked into showing a page from any web site. If a malicious link is sent to a logged‑in editor, the admin console will embed that external page and treat it as a trusted preview, allowing the attacker to read or change protected content using the editor’s rights. Updating to TinCMS 3.14.0 and @tinacms/app 2.5.14 fixes the problem.
What to do
- Update GitHub Actions tinacms to version 3.14.0.
- Update tinacms app to version 2.5.14.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | tinacms | tinacms | < 3.14.0 |
| – | @tinacms | app | < 2.5.14 |
| npm | GitHub Actions | tinacms |
<= 3.13.0 Fix: upgrade to 3.14.0
|
| npm | tinacms | app |
<= 2.5.13 Fix: upgrade to 2.5.14
|
Original advisory text
TinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragment
Tina is a headless content management system. Prior to tinacms 3.14.0 and @tinacms/app 2.5.14, the /~/* admin preview route in packages/tinacms/src/admin/index.tsx can turn an attacker-controlled hash-router splat into an off-origin iframe URL through packages/@tinacms/app/src/preview.tsx, while packages/@tinacms/app/src/lib/preview-origin.ts derives expectedOrigin from that same URL for the GraphQL message channel in packages/@tinacms/app/src/lib/graphql-reducer.ts. An unauthenticated attacker can send a crafted link to a signed-in editor, cause the admin to frame an attacker origin, and have that frame treated as the trusted preview. The attacker-controlled frame can submit GraphQL reads or mutations that the admin executes with the editor credentials, exposing or modifying protected content. This issue is fixed in tinacms 3.14.0 and @tinacms/app 2.5.14.
References
- https://github.com/tinacms/tinacms/pull/7522 Patch
- https://github.com/tinacms/tinacms/security/advisories/GHSA-x34j-47hf-4xg7 Vendor Advisory
- https://github.com/tinacms/tinacms/commit/b57dbf4b56201aef15cd92caa49fd12ab96bbe... Patch
- https://github.com/tinacms/tinacms/releases/tag/@tinacms/[email protected] URL
- https://github.com/tinacms/tinacms/releases/tag/[email protected] URL
- https://github.com/advisories/GHSA-x34j-47hf-4xg7
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/108xxx/CVE-2026-1082... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-108261 Vendor Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker full control (estimated)
Type
CWE-346Origin Validation Error
CWE-441Unintended Proxy or Intermediary ('Confused Deputy')
CWE-601Open Redirect
Timeline
Published9 Oct 2026
Updated10 Oct 2026
First seen9 Oct 2026
Sources
CVE-2026-108261 · NVD
CVE-2026-108261 · MITRE
GHSA-x34j-47hf-4xg7 · GHSA
CVE-2026-108261 · OSV
Track software like this
Free during beta