CVE-2025-68278
High · 8.8CVSS
8.8
EPSS
0.5%
Published
Dec 18, 2025
CISA due date
—
The record
Tina is a headless content management system. In tinacms prior to version 3.1.1, tinacms uses the gray-matter package in an insecure way allowing attackers that can control the content of the processed markdown files, e.g., blog posts, to execute arbitrary code. tinacms version 3.1.1, @tinacms/cli version 2.0.4, and @tinacms/graphql version 2.0.3 contain a fix for the issue.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | @tinacms/cli | 0 | 2.0.4 |
| npm | @tinacms/graphql | 0 | 2.0.3 |
| npm | tinacms | 0 | 3.1.1 |
Related vulnerabilities
- GHSA-529f-9qwm-9628 tinacms is vulnerable to arbitrary code execution Same vulnerability
- GHSA-4936-9hrh-qqpw @tinacms/cli: Remote Code Execution in @tinacms/cli via Forestry migration — unsanitised… Also affects @tinacms/cli
- GHSA-m48g-4wr2-j2h6 TinaCMS CLI has Arbitrary File Read via Disabled Vite Filesystem Restriction Also affects @tinacms/cli
- GHSA-2f24-mg4x-534q TinaCMS Vulnerable to Path Traversal Leading to Arbitrary File Read, Write and Delete Also affects @tinacms/cli
- GHSA-8pw3-9m7f-q734 TinaCMS CLI Dev Server Vulnerable to Cross-Origin File Exfiltration via CORS… Also affects @tinacms/cli
- CVE-2026-28792 Tina is a headless content management system. Also affects @tinacms/cli
- CVE-2026-28793 Tina is a headless content management system. Also affects @tinacms/cli
- CVE-2026-29066 Tina is a headless content management system. Also affects @tinacms/cli