Executive brief
TinaCMS, a content management system used for website editing, contains a security flaw in how it handles communication between different browser windows and frames. An attacker could trick an authenticated editor into visiting a malicious website, allowing the attacker to hijack the editor's session, manipulate content, or steal authentication tokens. This could lead to unauthorized changes to the website or full account takeover for the CMS administrator.
Technical details
TinaCMS fails to validate the origin and source of window message events in several components, including the useTina overlay handler, the OAuth authentication popup handler, and the GraphQL reducer for admin-preview iframes. By acting on event.data without verifying event.origin or event.source, the application is vulnerable to message forgery. An attacker-controlled page in an opener or iframe relationship with the Tina admin can drive the editor, inject malicious preview content, or intercept OAuth tokens to take over sessions. Additionally, insufficient URL sanitization in rich-text content allows for stored XSS. The fix involves implementing allow-lists for trusted origins and ensuring postMessage calls use explicit target origins instead of wildcards.
Affected products
- tinacms tinacms < 3.9.3
- tinacms @tinacms/app < 2.5.6
Timeline
- 2026-06-15: patched: Fix merged in PR #7056
- 2026-06-16: advisory: GitHub Security Advisory published
- 2026-07-01: disclosed: CVE published to NVD