# CVE-2026-55661: TinaCMS stored XSS in rich-text link and image rendering

Source: https://junglewise.ai/threats/cve-2026-55661-tinacms-stored-xss-in-rich-text-link-and-image-rendering  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-01. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-55661 · Severity: medium · CVSS 4 · Published 2026-07-01

TinaCMS is an open-source headless CMS that allows content editors to create and manage rich-text content. The platform fails to properly validate URLs in links and images, allowing a content editor or attacker with imported content to embed malicious code that executes when other users view the content. This stored XSS vulnerability affects all editors and visitors who view compromised content, potentially leading to account compromise or data theft.

Technologies: [tinacms (npm)](https://junglewise.ai/threats/technologies/tinacms). Vendors: [npm](https://junglewise.ai/threats/vendors/npm), [TinaCMS](https://junglewise.ai/threats/vendors/tinacms).

## Quick answers

**Is CVE-2026-55661 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-55661 being exploited in the wild.

**How severe is CVE-2026-55661?** Medium severity, with a CVSS score of 4, published 1 July 2026.

**Which products and versions are affected?** @tinacms/mdx (npm) < 2.1.7, SEMVER:introduced=0,fixed=2.1.7; tinacms (npm) < 3.9.3, SEMVER:introduced=0,fixed=3.9.3; TinaCMS MDX < 2.1.7.

**Is there a fix for CVE-2026-55661?** Yes. @tinacms/mdx (npm): upgrade to 2.1.7 or later; tinacms (npm): upgrade to 3.9.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-55661 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-55661?** Check whether you run @tinacms/mdx (npm), tinacms (npm) or TinaCMS MDX at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @tinacms/mdx (npm): upgrade to 2.1.7 or later

  ```sh
  npm install @tinacms/mdx@2.1.7
  ```

- tinacms (npm): upgrade to 3.9.3 or later

  ```sh
  npm install tinacms@3.9.3
  ```


## Technical details

The vulnerability is a stored cross-site scripting (XSS) flaw (CWE-79, CWE-87) in TinaCMS's Slate-based rich-text editor. The slatejson parser and default link/image renderers fail to sanitize the URL field on Slate link and image nodes, allowing dangerous URL schemes like javascript: and data:text/html to pass through unfiltered. Attackers can bypass simple filters using case variants, whitespace-padding, and control-character obfuscation. Any actor with rich-text authoring capability—including lower-privileged editors or external content import mechanisms—can achieve persistent XSS. The fix was released in PR #7056 via a sanitizeUrl() helper that performs case-insensitive, whitespace/control-character-normalized scheme allow-listing, applied recursively at parse time and during rendering. Patched versions: tinacms 3.9.3 and @tinacms/mdx 2.1.7.

## Affected products

- TinaCMS tinacms < 3.9.3
- TinaCMS @tinacms/mdx < 2.1.7

## Identifiers

- CVE-2026-55661
- GHSA-2vcc-5v34-9jc8

## Timeline

- 2026-06-18: disclosed
- 2026-06-15: patched: Fix merged in PR #7056

## References

- [https://github.com/tinacms/tinacms/security/advisories/GHSA-2vcc-5v34-9jc8](https://github.com/tinacms/tinacms/security/advisories/GHSA-2vcc-5v34-9jc8)
- [https://github.com/tinacms/tinacms/pull/7056](https://github.com/tinacms/tinacms/pull/7056)
- [https://github.com/tinacms/tinacms](https://github.com/tinacms/tinacms)

## Related threats

- [TinaCMS admin preview iframe origin validation bypass](https://junglewise.ai/threats/cve-2026-108261-tinacms-admin-preview-iframe-loads-an-attacker-controlled-origin)
- [TinaCMS origin validation error in postMessage handlers](https://junglewise.ai/threats/cve-2026-55660-tinacms-origin-validation-error-in-postmessage-handlers)
- [TinaCMS path traversal in media upload handler](https://junglewise.ai/threats/cve-2026-28791-tinacms-path-traversal-in-media-upload-handler)
- [TinaCMS arbitrary code execution in markdown frontmatter](https://junglewise.ai/threats/cve-2025-68278-tinacms-arbitrary-code-execution-in-markdown-frontmatter)