Is CVE-2026-108261 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-108261 being exploited in the wild.

How severe is CVE-2026-108261?

Critical severity, with a CVSS score of 9.3, published 9 October 2026.

Which products and versions are affected?

@tinacms/app (npm) <= 2.5.13, SEMVER:introduced=0,fixed=2.5.14; tinacms (npm) <= 3.13.0, SEMVER:introduced=0,fixed=3.14.0; TinaCMS @Tinacms/App <=2.5.12; TinaCMS <=3.12.1.

How is CVE-2026-108261 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-108261?

Check whether you run @tinacms/app (npm), tinacms (npm), TinaCMS @Tinacms/App or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-108261: TinaCMS admin preview iframe origin validation bypass

Q: Which products and versions are affected?

@tinacms/app (npm) <= 2.5.13, SEMVER:introduced=0,fixed=2.5.14; tinacms (npm) <= 3.13.0, SEMVER:introduced=0,fixed=3.14.0; TinaCMS @Tinacms/App <=2.5.12; TinaCMS <=3.12.1.

Q: Is there a fix for CVE-2026-108261?

Yes. @tinacms/app (npm): upgrade to 2.5.14 or later; tinacms (npm): upgrade to 3.14.0 or later. Until then: Restrict editor access to TinaCMS admin until patched, or deploy a reverse proxy that validates URL fragments and blocks protocol-relative URLs in the /~/* route. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-108261 attacked?

It is attacked over the network, in a web application.

Q: Am I affected by CVE-2026-108261?

Check whether you run @tinacms/app (npm), tinacms (npm), TinaCMS @Tinacms/App or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-108261 · Severity: critical · CVSS 9.3 · Published 2026-10-09

TinaCMS is a headless CMS that includes an admin dashboard with a preview iframe. The admin accepts an attacker-controlled origin from the URL fragment without validation, loads it in the iframe, and then treats it as trustworthy for API requests. An attacker can trick a logged-in editor into clicking a malicious link to read and modify all site content using the editor's authentication credentials.

Technologies: tinacms (npm). Vendors: npm, TinaCMS.

Quick answers

Is CVE-2026-108261 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-108261 being exploited in the wild.
How severe is CVE-2026-108261?: Critical severity, with a CVSS score of 9.3, published 9 October 2026.
Which products and versions are affected?: @tinacms/app (npm) <= 2.5.13, SEMVER:introduced=0,fixed=2.5.14; tinacms (npm) <= 3.13.0, SEMVER:introduced=0,fixed=3.14.0; TinaCMS @Tinacms/App <=2.5.12; TinaCMS <=3.12.1.
Is there a fix for CVE-2026-108261?: Yes. @tinacms/app (npm): upgrade to 2.5.14 or later; tinacms (npm): upgrade to 3.14.0 or later. Until then: Restrict editor access to TinaCMS admin until patched, or deploy a reverse proxy that validates URL fragments and blocks protocol-relative URLs in the /~/* route. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-108261 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-108261?: Check whether you run @tinacms/app (npm), tinacms (npm), TinaCMS @Tinacms/App or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@tinacms/app (npm): upgrade to 2.5.14 or later
```
npm install @tinacms/app@2.5.14
```
tinacms (npm): upgrade to 3.14.0 or later
```
npm install tinacms@3.14.0
```

Restrict editor access to TinaCMS admin until patched, or deploy a reverse proxy that validates URL fragments and blocks protocol-relative URLs in the /~/* route.

Technical details

The vulnerability stems from the router's splat parameter (`/~/*`) being directly assigned to the iframe source without same-origin validation. A crafted fragment like `#/~//attacker.example/p` becomes the protocol-relative URL `//attacker.example/p`, causing the admin to frame an external site. The same unvalidated URL is used to derive `expectedOrigin`, the only trust anchor for the admin-to-preview `postMessage` channel. The attacker's frame can then submit arbitrary GraphQL mutations, which execute with the signed-in editor's authentication token and return results to the attacker's origin. The vulnerability bypasses the incomplete fix in version 3.9.3 which added sender-side origin checks but never validated the URL being compared.

Affected products

TinaCMS TinaCMS <=3.12.1
TinaCMS @tinacms/app <=2.5.12

Identifiers

CVE-2026-108261
GHSA-x34j-47hf-4xg7

Timeline

2026-10-09: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.