Web Components
Monthly
Stored cross-site scripting in TinaCMS's @tinacms/web-components package (all versions up to and including 0.2.0) lets an authenticated content author save a rich-text link whose URL uses a script-capable scheme such as javascript:, which the tina-markdown element then writes straight into an anchor href; a visitor who clicks the rendered link executes attacker-controlled script in the site's origin. Because the payload persists in CMS content and runs in the victim's origin, an editor or administrator who clicks it can expose TinaCMS admin credentials held on that site (CVSS 7.6, AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N, CWE-79). Key prerequisites are an author-level account, a deployment that renders content via the web-components renderer rather than the sanitizing React, static, or Astro renderers, and a victim click; no public exploit code and no confirmed active exploitation were identified at time of analysis.
Stored cross-site scripting in TinaCMS's @tinacms/web-components package (all versions up to and including 0.2.0) lets an authenticated content author save a rich-text link whose URL uses a script-capable scheme such as javascript:, which the tina-markdown element then writes straight into an anchor href; a visitor who clicks the rendered link executes attacker-controlled script in the site's origin. Because the payload persists in CMS content and runs in the victim's origin, an editor or administrator who clicks it can expose TinaCMS admin credentials held on that site (CVSS 7.6, AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N, CWE-79). Key prerequisites are an author-level account, a deployment that renders content via the web-components renderer rather than the sanitizing React, static, or Astro renderers, and a victim click; no public exploit code and no confirmed active exploitation were identified at time of analysis.