TinaCMS CVE-2026-108261

Exploitation works against default configurations of the TinaCMS admin (packages/tinacms/src/admin/index.tsx) - no special feature flag or non-default setting is required, because the vulnerable /~/* hash-router preview route and the unvalidated expectedOrigin derivation ship enabled. The concrete prerequisites are: (1) a victim must be running tinacms <=3.13.0 and/or @tinacms/app <=2.5.13; (2) a user must be actively signed in to the admin with a valid editor token; and (3) that editor must open the attacker-crafted link containing a protocol-relative hash fragment (e.g. #/~//attacker.example/p) - this required user interaction (UI:R) is the primary limiting factor. The iframe ships with no sandbox attribute and the admin bundle ships no CSP, so no browser-side control blocks the off-origin frame; however, the attack cannot proceed without an authenticated editor being socially engineered into clicking, which bounds it to targeted rather than unattended exploitation.

This is a genuine high-priority issue, and the CVSS 9.3 is well-supported by the technical evidence rather than being score inflation. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N) is internally consistent with the description: an unauthenticated remote attacker (PR:N) exploits an origin-validation flaw (CWE-346) with low complexity (AC:L), and the scope change (S:C) is justified because the attacker-controlled iframe is elevated to act with the signed-in editor's credentials against the content API, crossing a trust boundary. The one meaningful mitigating signal is UI:R - exploitation requires a logged-in editor to open the crafted link, so this is not wormable/automatable mass exploitation but targeted social engineering of CMS editors. No EPSS score and no CISA KEV entry were provided in the input, so there is no evidence of active exploitation; however, the GHSA advisory includes a working proof-of-concept, so publicly available exploit code exists. The absence of an EPSS figure means exploitation probability cannot be quantified from the data given. Net: treat as a priority patch for any TinaCMS deployment with real editors, while recognizing exploitation depends on tricking an authenticated editor rather than unattended remote compromise.

An attacker crafts a link to a victim site's admin with a doubled-slash hash fragment (e.g. #/~//attacker.example/p) and sends it to a signed-in TinaCMS editor via phishing. When the editor opens it, the admin frames the attacker's external origin as the trusted preview; a working PoC exists in the GHSA advisory. The attacker's frame then issues GraphQL reads and mutations that the admin executes with the editor's token, exfiltrating or altering protected content back to the attacker's origin.