Conoce las vulnerabilidades. Protege tus aplicaciones.

Alta 09.10.2026

CVE-2026-108259

Tina: Inyección de código mediante un nombre de rama de Git no escapado en el código fuente generado del cliente

Una vulnerabilidad en TinaCMS CLI permite la ejecución arbitraria de JavaScript durante la compilación del proyecto debido a la inserción de un nombre de rama de Git sin escapar en el código cliente generado.

npm

@tinacms/cli

Alta 17.09.2026

CVE-2026-63506

Tina: [Broken Access Control] letting any TinaCloud user authorize against any self-hosted site

npm

next-tinacms-azure, @tinacms/auth

Media 19.08.2026

CVE-2026-63123

Tina: Cross-origin `POST /media/upload/*` requests can write arbitrary files into the Tina dev server media root

npm

@tinacms/cli

Alta 19.06.2026

CVE-2026-54074

@tinacms/cli: Remote Code Execution in @tinacms/cli via Forestry migration — unsanitised __TINA_INTERNAL__ marker in user-controlled YAML labels

npm

@tinacms/cli

Alta 01.04.2026

CVE-2026-34603

@tinacms/graphql's Media Endpoints Can Escape the Media Root via Symlinks or Junctions

npm

@tinacms/graphql

Media 12.03.2026

CVE-2026-29066

TinaCMS CLI has Arbitrary File Read via Disabled Vite Filesystem Restriction

npm

@tinacms/cli

Alta 12.03.2026

CVE-2026-28793

TinaCMS Vulnerable to Path Traversal Leading to Arbitrary File Read, Write and Delete

npm

@tinacms/cli

Crítica 12.03.2026

CVE-2026-28792

TinaCMS CLI Dev Server Vulnerable to Cross-Origin File Exfiltration via CORS Misconfiguration + Path Traversal in TinaCMS

npm

@tinacms/cli

Alta 12.03.2026

CVE-2026-28791

Tina: Path Traversal in Media Upload Handle

npm

tinacms

Alta 18.12.2025

CVE-2025-68278

tinacms is vulnerable to arbitrary code execution

npm

tinacms, @tinacms/cli, @tinacms/graphql

Alta 03.09.2024

CVE-2024-45391

Tina search token leak via lock file in TinaCMS

npm

@tinacms/cli

Alta 08.02.2023

CVE-2023-25164

Sensitive Information leak via Script File in TinaCMS

npm

@tinacms/cli