Which versions of TinaCMS are affected by CVE-2026-55660?

TinaCMS editors are vulnerable to session hijacking through cross-window message spoofing, allowing attackers to impersonate authenticated editors and modify content if they trick users into visiting…. A patch is available.

How to fix or mitigate CVE-2026-55660?

Within 24 hours: Identify all instances of tinacms and @tinacms/app packages in production and review audit logs for suspicious editor activity or unauthorized content changes. Within 7 days: Apply the vendor patch available per vendor advisory (PR #7056) to all TinaCMS installations and verify deployment across all environments. Within 30 days: Conduct a comprehensive audit of all content modifications from the past 90 days to identify and remediate any unauthorized editorial changes.

TinaCMS CVE-2026-55660

Q: What is the CVSS score of CVE-2026-55660?

CVE-2026-55660 has a CVSS 4.0 base score of 7.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-41143 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-06-19 https://github.com/tinacms/tinacms

GHSA-g5qx-h5f3-mp2f

XSS

7.6

CVSS 4.0 · Vendor: https://github.com/tinacms/tinacms

Severity by source

Vendor (https://github.com/tinacms/tinacms) PRIMARY

7.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.8 MEDIUM

Network-delivered but requires a logged-in editor plus an opener/iframe relationship and victim interaction, so AC:H and UI:R; attacker needs no prior auth (PR:N); high confidentiality/integrity via session takeover and content injection, no availability impact.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (https://github.com/tinacms/tinacms).

CVSS VectorVendor: https://github.com/tinacms/tinacms

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Updated

Jul 01, 2026 - 21:29 vuln.today

v3 (cvss_changed)

Analysis Updated

Jul 01, 2026 - 21:28 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 01, 2026 - 21:22 vuln.today

cvss_changed

CVSS changed

Jul 01, 2026 - 21:22 NVD

7.6 (HIGH)

Source Code Evidence Fetched

Jun 19, 2026 - 23:33 vuln.today

Analysis Generated

Jun 19, 2026 - 23:33 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

1 npm packages depend on @tinacms/app (1 direct, 0 indirect)
3 npm packages depend on tinacms (3 direct, 0 indirect)

Ecosystem-wide dependent count for version 2.5.6 and other introduced versions.

DescriptionCVE.org

TinaCMS registers window message listeners - the useTina overlay handler, the OAuth authentication popup handler, and the admin↔preview iframe GraphQL reducer - that act on event.data without verifying event.origin or event.source, and post messages using non-specific target origins. A page the victim visits (or a window in an opener/iframe relationship with a Tina admin) can forge messages to drive the editor, inject preview content, or observe/forge the OAuth popup channel to take over an authenticated editing session.

Fixed in #7056 by allow-listing trusted origins and verifying event.source (isFromAdmin, isFromTrustedPreviewOrigin), and by posting only to explicit target origins (never "*").

Note: the rich-text URL-sanitization issue previously bundled here has been split into its own advisory (GHSA-2vcc-5v34-9jc8) so each vulnerability can receive a distinct CVE.

AnalysisAI

Cross-window message spoofing in TinaCMS (npm tinacms and @tinacms/app) lets a malicious web page hijack an authenticated editing session because the useTina overlay handler, the OAuth authentication popup handler, and the admin↔preview iframe GraphQL reducer act on window.postMessage event.data without validating event.origin or event.source, and reply with wildcard target origins. An attacker who lures an authenticated Tina editor to a crafted page (or gains an opener/iframe relationship with the Tina admin) can forge messages to drive the editor, inject preview content, or observe and forge the OAuth popup channel to take over the session. There is no public exploit identified at time of analysis; a vendor patch is available in PR #7056 and the flaw carries a CVSS 4.0 base score of 7.6.

Technical ContextAI

The vulnerability lives in the browser messaging layer that TinaCMS uses to coordinate its editing UI. TinaCMS is a Git-backed headless CMS whose admin app communicates across window boundaries using the HTML5 window.postMessage API: the useTina hook receives overlay/edit events, the OAuth login flow uses a popup that posts credentials/tokens back to the opener, and the admin frame exchanges GraphQL requests/responses with an embedded preview iframe. Secure use of postMessage requires the receiver to check event.origin (and often event.source) and the sender to specify an exact targetOrigin rather than '*'. Here none of the three listeners verified origin or source, and outgoing messages used non-specific target origins, so any window that can reach these listeners can inject or intercept data. Although tagged CWE-79 (Cross-site Scripting) and labeled XSS, the true root cause is missing origin/authentication of cross-document messages (closer to CWE-345/CWE-346 improper origin validation); the XSS framing reflects that injected preview content can carry script-bearing payloads into the editor context.

RemediationAI

Upgrade tinacms and @tinacms/app to the patched release that includes GitHub PR #7056, which allow-lists trusted origins, verifies event.source via isFromAdmin and isFromTrustedPreviewOrigin, and posts only to explicit target origins instead of '*'; consult the vendor advisory GHSA-g5qx-h5f3-mp2f (https://github.com/tinacms/tinacms/security/advisories/GHSA-g5qx-h5f3-mp2f) and PR https://github.com/tinacms/tinacms/pull/7056 for the exact fixed version. An exact patched version number was not provided in the input, so confirm it against the advisory before deploying - do not assume a version. Until upgrade, reduce exposure by restricting who can reach the Tina admin (serve it only to authenticated editors behind SSO/VPN rather than on a public URL), instructing editors not to browse untrusted sites in the same browser session where the admin is open, and adding a strict Content-Security-Policy frame-ancestors directive plus X-Frame-Options to prevent the admin from being embedded as an iframe by attacker pages; these controls narrow the opener/iframe attack surface but do not stop a maliciously crafted popup/opener relationship, so they are stopgaps, not substitutes for the patch.