TinaCMS CLI CVE-2026-108259

Exploitation requires a TinaCMS project whose build runs @tinacms/cli codegen (notably preview builds) using versions <= 2.7.0, AND an attacker able to control the Git branch value that the CLI reads from VERCEL_GIT_COMMIT_REF, GITHUB_BRANCH, or HEAD - for example by pushing a branch or opening a pull request whose branch name is consumed by the CI/preview pipeline. The branch name must be git-check-ref-format-valid, which permits a single quote (GITHUB_BRANCH is free text and additionally permits backslash/newline); the quote closes the generated URL string literal and injects an expression that runs when the generated client module is imported during the build. Limiting factors: the codegen step and the import of the generated client must actually execute in the build (so AC is high), the attacker needs some privilege to influence the branch (PR:L, not fully anonymous in typical configurations), and only versions at or below 2.7.0 are affected - 3.0.0 emits all values as JS literals via JSON.stringify.

This is a genuine, well-substantiated code-injection flaw (CWE-94) rather than an inflated high-CVSS issue, but its real-world priority is moderate and gated by preconditions. The provided CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N = 8.2) is internally coherent: high complexity reflects the need for a crafted branch name to flow through codegen during a preview build, low privileges reflect the attacker's need to influence the Git branch (e.g., via a pushed branch, pull request, or control of GITHUB_BRANCH/VERCEL_GIT_COMMIT_REF), and the changed scope (S:C) is justified because injected JavaScript executes in the build process rather than only the generated client module. A detailed proof-of-concept - including a git-check-ref-format-valid payload branch (x'+(globalThis.__TINA_PROBE='hit')+') and a full reproduction harness - is published in the GHSA advisory, so publicly available exploit code exists; however, there is NO EPSS score and NO CISA KEV entry in the provided data, so there is no evidence of active or widespread exploitation. The absence of EPSS/KEV combined with the AC:H build-pipeline dependency suggests this is a supply-chain/CI-hardening concern most relevant to teams running TinaCMS preview builds on untrusted branch input, not a mass-exploitation threat. Authentication requirements map to PR:L (authenticated/some access to influence the branch), consistent with the CVSS vector.

An attacker who can introduce a branch name into a TinaCMS preview build pipeline (for example by opening a pull request or pushing a branch whose name is read from VERCEL_GIT_COMMIT_REF, GITHUB_BRANCH, or HEAD) crafts a git-valid branch name containing a quote, such as x'+(globalThis.__TINA_PROBE='hit')+'. When @tinacms/cli codegen runs, the raw branch name is interpolated unescaped into the generated client module's URL string literal; importing that module during the build terminates the string and executes the attacker's JavaScript with build-process privileges, allowing theft of environment credentials or tampering with deployment artifacts. A complete working proof-of-concept and reproduction steps are published in the GHSA advisory.