Is CVE-2026-55660 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-55660 being exploited in the wild.

How severe is CVE-2026-55660?

High severity, with a CVSS score of 4, published 1 July 2026.

Which products and versions are affected?

@tinacms/app (npm) < 2.5.6, SEMVER:introduced=0,fixed=2.5.6; tinacms (npm) < 3.9.3, SEMVER:introduced=0,fixed=3.9.3; TinaCMS App < 2.5.6.

Is there a fix for CVE-2026-55660?

Yes. @tinacms/app (npm): upgrade to 2.5.6 or later; tinacms (npm): upgrade to 3.9.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-55660 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-55660?

Check whether you run @tinacms/app (npm), tinacms (npm) or TinaCMS App at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-55660: TinaCMS origin validation error in postMessage handlers

Q: Which products and versions are affected?

@tinacms/app (npm) < 2.5.6, SEMVER:introduced=0,fixed=2.5.6; tinacms (npm) < 3.9.3, SEMVER:introduced=0,fixed=3.9.3; TinaCMS App < 2.5.6.

Q: Is there a fix for CVE-2026-55660?

Yes. @tinacms/app (npm): upgrade to 2.5.6 or later; tinacms (npm): upgrade to 3.9.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-55660 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-55660?

Check whether you run @tinacms/app (npm), tinacms (npm) or TinaCMS App at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-55660 · Severity: high · CVSS 4 · Published 2026-07-01

TinaCMS, a content management system used for website editing, contains a security flaw in how it handles communication between different browser windows and frames. An attacker could trick an authenticated editor into visiting a malicious website, allowing the attacker to hijack the editor's session, manipulate content, or steal authentication tokens. This could lead to unauthorized changes to the website or full account takeover for the CMS administrator.

Technologies: tinacms (npm). Vendors: npm, TinaCMS.

Quick answers

Is CVE-2026-55660 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-55660 being exploited in the wild.
How severe is CVE-2026-55660?: High severity, with a CVSS score of 4, published 1 July 2026.
Which products and versions are affected?: @tinacms/app (npm) < 2.5.6, SEMVER:introduced=0,fixed=2.5.6; tinacms (npm) < 3.9.3, SEMVER:introduced=0,fixed=3.9.3; TinaCMS App < 2.5.6.
Is there a fix for CVE-2026-55660?: Yes. @tinacms/app (npm): upgrade to 2.5.6 or later; tinacms (npm): upgrade to 3.9.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55660 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-55660?: Check whether you run @tinacms/app (npm), tinacms (npm) or TinaCMS App at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@tinacms/app (npm): upgrade to 2.5.6 or later
```
npm install @tinacms/app@2.5.6
```
tinacms (npm): upgrade to 3.9.3 or later
```
npm install tinacms@3.9.3
```

Technical details

TinaCMS fails to validate the origin and source of window message events in several components, including the useTina overlay handler, the OAuth authentication popup handler, and the GraphQL reducer for admin-preview iframes. By acting on event.data without verifying event.origin or event.source, the application is vulnerable to message forgery. An attacker-controlled page in an opener or iframe relationship with the Tina admin can drive the editor, inject malicious preview content, or intercept OAuth tokens to take over sessions. Additionally, insufficient URL sanitization in rich-text content allows for stored XSS. The fix involves implementing allow-lists for trusted origins and ensuring postMessage calls use explicit target origins instead of wildcards.

Affected products

tinacms tinacms < 3.9.3
tinacms @tinacms/app < 2.5.6

Identifiers

CVE-2026-55660
GHSA-g5qx-h5f3-mp2f

Timeline

2026-06-15: patched: Fix merged in PR #7056
2026-06-16: advisory: GitHub Security Advisory published
2026-07-01: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.