# CVE-2026-55660: TinaCMS origin validation error in postMessage handlers

Source: https://junglewise.ai/threats/cve-2026-55660-tinacms-origin-validation-error-in-postmessage-handlers  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-01. Updated: 2026-07-01  
License: CC BY 4.0 with a link back

CVE-2026-55660 · Severity: high · CVSS 4 · Published 2026-07-01

TinaCMS, a content management system used for website editing, contains a security flaw in how it handles communication between different browser windows and frames. An attacker could trick an authenticated editor into visiting a malicious website, allowing the attacker to hijack the editor's session, manipulate content, or steal authentication tokens. This could lead to unauthorized changes to the website or full account takeover for the CMS administrator.

Technologies: [tinacms (npm)](https://junglewise.ai/threats/technologies/tinacms). Vendors: [npm](https://junglewise.ai/threats/vendors/npm), [TinaCMS](https://junglewise.ai/threats/vendors/tinacms).

## Quick answers

**Is CVE-2026-55660 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-55660 being exploited in the wild.

**How severe is CVE-2026-55660?** High severity, with a CVSS score of 4, published 1 July 2026.

**Which products and versions are affected?** @tinacms/app (npm) < 2.5.6, SEMVER:introduced=0,fixed=2.5.6; tinacms (npm) < 3.9.3, SEMVER:introduced=0,fixed=3.9.3; TinaCMS App < 2.5.6.

**Is there a fix for CVE-2026-55660?** Yes. @tinacms/app (npm): upgrade to 2.5.6 or later; tinacms (npm): upgrade to 3.9.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-55660 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-55660?** Check whether you run @tinacms/app (npm), tinacms (npm) or TinaCMS App at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @tinacms/app (npm): upgrade to 2.5.6 or later

  ```sh
  npm install @tinacms/app@2.5.6
  ```

- tinacms (npm): upgrade to 3.9.3 or later

  ```sh
  npm install tinacms@3.9.3
  ```


## Technical details

TinaCMS fails to validate the origin and source of window message events in several components, including the useTina overlay handler, the OAuth authentication popup handler, and the GraphQL reducer for admin-preview iframes. By acting on event.data without verifying event.origin or event.source, the application is vulnerable to message forgery. An attacker-controlled page in an opener or iframe relationship with the Tina admin can drive the editor, inject malicious preview content, or intercept OAuth tokens to take over sessions. Additionally, insufficient URL sanitization in rich-text content allows for stored XSS. The fix involves implementing allow-lists for trusted origins and ensuring postMessage calls use explicit target origins instead of wildcards.

## Affected products

- tinacms tinacms < 3.9.3
- tinacms @tinacms/app < 2.5.6

## Identifiers

- CVE-2026-55660
- GHSA-g5qx-h5f3-mp2f

## Timeline

- 2026-06-15: patched: Fix merged in PR #7056
- 2026-06-16: advisory: GitHub Security Advisory published
- 2026-07-01: disclosed: CVE published to NVD

## References

- [https://github.com/tinacms/tinacms/pull/7056](https://github.com/tinacms/tinacms/pull/7056)
- [https://github.com/tinacms/tinacms/security/advisories/GHSA-g5qx-h5f3-mp2f](https://github.com/tinacms/tinacms/security/advisories/GHSA-g5qx-h5f3-mp2f)

## Related threats

- [TinaCMS admin preview iframe origin validation bypass](https://junglewise.ai/threats/cve-2026-108261-tinacms-admin-preview-iframe-loads-an-attacker-controlled-origin)
- [TinaCMS stored XSS in rich-text link and image rendering](https://junglewise.ai/threats/cve-2026-55661-tinacms-stored-xss-in-rich-text-link-and-image-rendering)
- [TinaCMS path traversal in media upload handler](https://junglewise.ai/threats/cve-2026-28791-tinacms-path-traversal-in-media-upload-handler)
- [TinaCMS arbitrary code execution in markdown frontmatter](https://junglewise.ai/threats/cve-2025-68278-tinacms-arbitrary-code-execution-in-markdown-frontmatter)