CVE-2026-54074: TinaCMS @tinacms/cli Remote Code Execution in Forestry migration

CVE-2026-54074 · Severity: high · CVSS 7.8 · Published 2026-07-01

TinaCMS is a popular headless CMS toolkit used by developers to manage website content. The CLI migration tool that converts Forestry-based projects to TinaCMS fails to sanitize user-supplied field labels before embedding them in auto-generated TypeScript configuration files. An attacker can craft a malicious Forestry project that, when migrated by a developer, injects and executes arbitrary code (stealing credentials, planting backdoors, modifying source code) during the dev/build process.

Technologies: @tinacms/cli (npm). Vendors: npm.

Quick answers

Is CVE-2026-54074 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-54074 being exploited in the wild.
How severe is CVE-2026-54074?
High severity, with a CVSS score of 7.8, published 1 July 2026.
Which products and versions are affected?
@tinacms/cli (npm) < 2.4.3, SEMVER:introduced=0,fixed=2.4.3.
Is there a fix for CVE-2026-54074?
Yes. @tinacms/cli (npm): upgrade to 2.4.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54074 attacked?
It is attacked with local access, in a software library.
Am I affected by CVE-2026-54074?
Check whether you run @tinacms/cli (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @tinacms/cli (npm): upgrade to 2.4.3 or later
    npm install @tinacms/cli@2.4.3

Technical details

The vulnerability exists in @tinacms/cli's Forestry migration command, specifically in the code generation pipeline. The transformForestryFieldsToTinaFields() function writes unsanitized forestryField.label and forestryField.name values into TinaField objects. These objects are then JSON.stringify-ed and passed to addVariablesToCode(), which uses a regex to unquote values matching the marker "__TINA_INTERNAL__:::(.*?):::" . Because JSON.stringify does not escape single quotes or backticks, an attacker can craft a payload using those characters to inject arbitrary code. The resulting string is written to tina/templates.ts/js and imported by tina/config.ts, which tinacms dev evaluates. The injected code is placed at module scope as a top-level IIFE, causing it to execute immediately when the config is imported, before the dev server initialization completes. No authentication is required; user interaction (running tinacms init and tinacms dev) is necessary. Patched in version 2.4.3 via a per-process random nonce marker that makes the payload unforgeable.

Affected products

  • TinaCMS @tinacms/cli <= 2.4.3

Identifiers

  • CVE-2026-54074
  • GHSA-4936-9hrh-qqpw

Timeline

  • 2026-06-19: disclosed: OSV and GitHub advisory published
  • 2026-06-02: patched: Fix merged in PR #7006; patched in version 2.4.3
  • 2026-05-23: exploited: PoC verified and working end-to-end

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.