Executive brief
TinaCMS is a popular headless CMS toolkit used by developers to manage website content. The CLI migration tool that converts Forestry-based projects to TinaCMS fails to sanitize user-supplied field labels before embedding them in auto-generated TypeScript configuration files. An attacker can craft a malicious Forestry project that, when migrated by a developer, injects and executes arbitrary code (stealing credentials, planting backdoors, modifying source code) during the dev/build process.
Technical details
The vulnerability exists in @tinacms/cli's Forestry migration command, specifically in the code generation pipeline. The transformForestryFieldsToTinaFields() function writes unsanitized forestryField.label and forestryField.name values into TinaField objects. These objects are then JSON.stringify-ed and passed to addVariablesToCode(), which uses a regex to unquote values matching the marker "__TINA_INTERNAL__:::(.*?):::" . Because JSON.stringify does not escape single quotes or backticks, an attacker can craft a payload using those characters to inject arbitrary code. The resulting string is written to tina/templates.ts/js and imported by tina/config.ts, which tinacms dev evaluates. The injected code is placed at module scope as a top-level IIFE, causing it to execute immediately when the config is imported, before the dev server initialization completes. No authentication is required; user interaction (running tinacms init and tinacms dev) is necessary. Patched in version 2.4.3 via a per-process random nonce marker that makes the payload unforgeable.
Affected products
- TinaCMS @tinacms/cli <= 2.4.3
Timeline
- 2026-06-19: disclosed: OSV and GitHub advisory published
- 2026-06-02: patched: Fix merged in PR #7006; patched in version 2.4.3
- 2026-05-23: exploited: PoC verified and working end-to-end
References
- https://github.com/tinacms/tinacms/security/advisories/GHSA-4936-9hrh-qqpw
- https://github.com/tinacms/tinacms/pull/7006
- https://github.com/tinacms/tinacms/commit/77665ae73dd4f9563d339535e76fa811a8abdfbb
- https://github.com/tinacms/tinacms
- https://github.com/tinacms/tinacms/releases/tag/@tinacms/cli@2.4.3