Is CVE-2026-29066 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-29066 being exploited in the wild.

How severe is CVE-2026-29066?

Low severity, with a CVSS score of 3.1, published 12 March 2026.

Which products and versions are affected?

@tinacms/cli (npm) SEMVER:introduced=0,fixed=2.1.8.

Is there a fix for CVE-2026-29066?

Yes. @tinacms/cli (npm): upgrade to 2.1.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-29066 attacked?

It is attacked over the network or from the adjacent network or with local access, in a software library.

Am I affected by CVE-2026-29066?

Check whether you run @tinacms/cli (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-29066: TinaCMS CLI arbitrary file read via disabled Vite filesystem restriction

CVE-2026-29066 · Severity: low · CVSS 3.1 · Published 2026-03-12

TinaCMS CLI is a command-line tool used by developers to manage content and run local development servers. The dev server disables a critical security feature in Vite (the underlying build tool), allowing anyone who can access the server port to read arbitrary files from the system, including SSH keys, configuration files, and environment variables containing secrets. This risk is especially severe in cloud development environments where the dev server port may be publicly exposed.

Technologies: @tinacms/cli (npm). Vendors: npm.

Quick answers

Is CVE-2026-29066 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-29066 being exploited in the wild.
How severe is CVE-2026-29066?: Low severity, with a CVSS score of 3.1, published 12 March 2026.
Which products and versions are affected?: @tinacms/cli (npm) SEMVER:introduced=0,fixed=2.1.8.
Is there a fix for CVE-2026-29066?: Yes. @tinacms/cli (npm): upgrade to 2.1.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-29066 attacked?: It is attacked over the network or from the adjacent network or with local access, in a software library.
Am I affected by CVE-2026-29066?: Check whether you run @tinacms/cli (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@tinacms/cli (npm): upgrade to 2.1.8 or later
```
npm install @tinacms/cli@2.1.8
```

Technical details

The vulnerability is an arbitrary file read flaw in the TinaCMS CLI dev server. The root cause is that Vite is configured with `server.fs.strict: false`, which disables filesystem access restrictions that normally protect against directory traversal attacks. The dev server also enables unrestricted CORS, facilitating DNS rebinding attacks. Attack vector is local network access to port 4001 (the default dev server port); no authentication or user interaction is required. An attacker who can reach the dev server can directly request absolute filesystem paths (e.g., `http://localhost:4001/etc/passwd`) and receive the file contents. This is particularly impactful in cloud IDEs and shared environments. The vulnerability affects all versions through 2.1.7; patched in version 2.1.8.

Affected products

TinaCMS CLI all versions prior to 2.1.8

Identifiers

CVE-2026-29066
GHSA-m48g-4wr2-j2h6

Timeline

2026-03-12: disclosed
2026-03-12: patched: Fixed in version 2.1.8

References

https://github.com/tinacms/tinacms/security/advisories/GHSA-m48g-4wr2-j2h6

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.