Junglewise Threat Intelligence

CVE-2026-54074: TinaCMS @tinacms/cli Remote Code Execution in Forestry migration

CVE-2026-54074 · Severity: high · CVSS 7.8 · Published 2026-07-01

Executive brief

TinaCMS is a popular headless CMS toolkit used by developers to manage website content. The CLI migration tool that converts Forestry-based projects to TinaCMS fails to sanitize user-supplied field labels before embedding them in auto-generated TypeScript configuration files. An attacker can craft a malicious Forestry project that, when migrated by a developer, injects and executes arbitrary code (stealing credentials, planting backdoors, modifying source code) during the dev/build process.

Technical details

The vulnerability exists in @tinacms/cli's Forestry migration command, specifically in the code generation pipeline. The transformForestryFieldsToTinaFields() function writes unsanitized forestryField.label and forestryField.name values into TinaField objects. These objects are then JSON.stringify-ed and passed to addVariablesToCode(), which uses a regex to unquote values matching the marker "__TINA_INTERNAL__:::(.*?):::" . Because JSON.stringify does not escape single quotes or backticks, an attacker can craft a payload using those characters to inject arbitrary code. The resulting string is written to tina/templates.ts/js and imported by tina/config.ts, which tinacms dev evaluates. The injected code is placed at module scope as a top-level IIFE, causing it to execute immediately when the config is imported, before the dev server initialization completes. No authentication is required; user interaction (running tinacms init and tinacms dev) is necessary. Patched in version 2.4.3 via a per-process random nonce marker that makes the payload unforgeable.

Affected products

  • TinaCMS @tinacms/cli <= 2.4.3

Timeline

  • 2026-06-19: disclosed: OSV and GitHub advisory published
  • 2026-06-02: patched: Fix merged in PR #7006; patched in version 2.4.3
  • 2026-05-23: exploited: PoC verified and working end-to-end

References

Related threats