Executive brief
TinaCMS CLI is a build tool for static sites using the TinaCMS headless CMS. Versions 1.0.0 through 1.0.8 expose sensitive environment variables (such as API keys for Algolia or other services) in generated script files, allowing any visitor to your site to discover and steal these credentials. This compromises security of connected third-party services and potentially allows account takeover.
Technical details
The vulnerability is an information exposure issue (CWE-200) in @tinacms/cli where sensitive values stored in process.env are leaked into generated script files accessible to site visitors. The vulnerable versions are @tinacms/cli 1.0.0 through 1.0.8; prior versions (pre-1.0.0) are not affected. The attack vector is network-based with no authentication required, meaning any unauthenticated visitor to an affected website can retrieve the exposed credentials from the script files. The fix is available in @tinacms/cli 1.0.9. Sites running vulnerable versions should immediately upgrade and rotate any exposed API keys or secrets.
Affected products
- TinaCMS CLI 1.0.0 to 1.0.8
Timeline
- 2023-02-08: disclosed
- 2023-02-08: patched: @tinacms/cli 1.0.9 released