Executive brief
TinaCMS is an open-source headless CMS that allows content editors to create and manage rich-text content. The platform fails to properly validate URLs in links and images, allowing a content editor or attacker with imported content to embed malicious code that executes when other users view the content. This stored XSS vulnerability affects all editors and visitors who view compromised content, potentially leading to account compromise or data theft.
Technical details
The vulnerability is a stored cross-site scripting (XSS) flaw (CWE-79, CWE-87) in TinaCMS's Slate-based rich-text editor. The slatejson parser and default link/image renderers fail to sanitize the URL field on Slate link and image nodes, allowing dangerous URL schemes like javascript: and data:text/html to pass through unfiltered. Attackers can bypass simple filters using case variants, whitespace-padding, and control-character obfuscation. Any actor with rich-text authoring capability—including lower-privileged editors or external content import mechanisms—can achieve persistent XSS. The fix was released in PR #7056 via a sanitizeUrl() helper that performs case-insensitive, whitespace/control-character-normalized scheme allow-listing, applied recursively at parse time and during rendering. Patched versions: tinacms 3.9.3 and @tinacms/mdx 2.1.7.
Affected products
- TinaCMS tinacms < 3.9.3
- TinaCMS @tinacms/mdx < 2.1.7
Timeline
- 2026-06-18: disclosed
- 2026-06-15: patched: Fix merged in PR #7056