# CVE-2024-45391: TinaCMS search token leak via lock file

Source: https://junglewise.ai/threats/cve-2024-45391-tinacms-search-token-leak-via-lock-file  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2024-09-03. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2024-45391 · Severity: low · CVSS 3.1 · Published 2024-09-03

TinaCMS is a popular headless CMS that stores content in GitHub repositories. The CLI tool inadvertently wrote sensitive search API tokens to the tina-lock.json lock file, which could be committed to public repositories. An attacker gaining access to this file could use the leaked token to query the search index without authorization, potentially exposing or manipulating indexed content.

Technologies: [@tinacms/cli (npm)](https://junglewise.ai/threats/technologies/tinacms-cli). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2024-45391 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2024-45391 being exploited in the wild.

**How severe is CVE-2024-45391?** Low severity, with a CVSS score of 3.1, published 3 September 2024.

**Which products and versions are affected?** @tinacms/cli (npm) SEMVER:introduced=0,fixed=1.6.2.

**Is there a fix for CVE-2024-45391?** Yes. @tinacms/cli (npm): upgrade to 1.6.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2024-45391 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2024-45391?** Check whether you run @tinacms/cli (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @tinacms/cli (npm): upgrade to 1.6.2 or later

  ```sh
  npm install @tinacms/cli@1.6.2
  ```


## Technical details

The @tinacms/cli package with versions prior to 1.6.2 incorrectly includes search configuration containing API tokens in the tina-lock.json lock file during the build process. The vulnerability stems from insufficient filtering of sensitive configuration fields before serializing the lock file. The attack vector is network-based with no authentication or user interaction required; an attacker only needs access to the lock file (commonly stored in version control). The vulnerability allows confidentiality breach through token theft and unauthorized search API access. The fix was released in @tinacms/cli@1.6.2, which filters out search configuration from the lock file output. Users must upgrade and rotate their search tokens immediately.

## Affected products

- TinaCMS @tinacms/cli < 1.6.2

## Identifiers

- CVE-2024-45391
- GHSA-4qrm-9h4r-v2fx

## Timeline

- 2024-09-03: disclosed: Vulnerability published as GHSA-4qrm-9h4r-v2fx and CVE-2024-45391
- 2024-09-03: patched: Fix released in @tinacms/cli@1.6.2

## References

- [https://github.com/tinacms/tinacms/security/advisories/GHSA-4qrm-9h4r-v2fx](https://github.com/tinacms/tinacms/security/advisories/GHSA-4qrm-9h4r-v2fx)
- [https://github.com/tinacms/tinacms/pull/4758](https://github.com/tinacms/tinacms/pull/4758)
- [https://github.com/tinacms/tinacms/commit/110f1ceea4574d636a64526648f7c8bf6539b26a](https://github.com/tinacms/tinacms/commit/110f1ceea4574d636a64526648f7c8bf6539b26a)
- [https://github.com/tinacms/tinacms](https://github.com/tinacms/tinacms)

## Related threats

- [TinaCMS CLI code injection via unescaped Git branch name](https://junglewise.ai/threats/cve-2026-108259-tina-code-injection-via-unescaped-git-branch-name-in-generated)
- [TinaCMS CLI cross-origin CSRF in media upload](https://junglewise.ai/threats/cve-2026-63123-tinacms-cli-cross-origin-csrf-in-media-upload)
- [TinaCMS @tinacms/cli Remote Code Execution in Forestry migration](https://junglewise.ai/threats/cve-2026-54074-tinacms-tinacms-cli-remote-code-execution-in-forestry-migration)
- [TinaCMS CLI arbitrary file read via disabled Vite filesystem restriction](https://junglewise.ai/threats/cve-2026-29066-tinacms-cli-arbitrary-file-read-via-disabled-vite-filesystem)
- [TinaCMS CLI path traversal in media endpoints](https://junglewise.ai/threats/cve-2026-28793-tinacms-path-traversal-in-cli-development-server-media-endpoints)