TinaCMS CVE-2026-108260

Requires (1) an authenticated TinaCMS content-author account able to save a rich-text link, (2) the target site to render that content specifically through the @tinacms/web-components tina-markdown element (versions <= 0.2.0) - the React, static, and Astro rich-text renderers are NOT affected because they call sanitizeUrl - and (3) a victim to actually click the rendered link (UI:R). Maximum impact (credential exposure) additionally requires the clicking victim to be a TinaCMS editor or administrator whose session/credentials live on that origin. Limiting factors: author-level privilege prerequisite, required victim click, and the narrow condition that the deployment uses the web-components renderer rather than the default React/Astro paths.

This is a stored (persistent) cross-site scripting flaw (CWE-79) rated CVSS 7.6 with vector AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N. The signals are internally consistent and credible: network-reachable, low complexity, but gated by two real friction points - PR:L means the attacker must already hold a TinaCMS content-author account, and UI:R means a victim must click the malicious link. The S:C (scope change) and C:H are justified because script executing in the site origin can read same-origin application data and, if the victim is an editor/admin, harvest TinaCMS admin credentials stored on that origin. No EPSS score, KEV listing, or public POC is present in the supplied data, so this is NOT a confirmed actively-exploited issue; it is a vendor-disclosed (GitHub advisory GHSA-c42q-qvc3-j6vg), patched vulnerability. Realistically this is a moderate-priority issue rather than a drop-everything emergency: the authenticated-author precondition plus required victim click, plus the fact that only the @tinacms/web-components renderer is affected (the six sibling React/Astro renderers already sanitize), substantially narrow the real-world attack surface. Treat as higher priority on multi-author sites where content-author accounts are loosely controlled.

A user with content-author access to a TinaCMS instance edits a rich-text field and inserts a link whose target uses a script-capable scheme (e.g. javascript:...), which is stored via the content API. When a site built on the @tinacms/web-components tina-markdown element renders that content and a visitor - ideally an editor or administrator - clicks the link, attacker-controlled script runs in the site's origin and can read same-origin data or exfiltrate stored admin credentials. No public exploit code is identified in the supplied data, though the patch's own test uses 'javascript:alert(1)' as the canonical trigger.