Detections
Analytics

SCA: security update for @tinacms/cli (GHSA-pwhx-cvv3-qj5c)

high Tenable Cloud Security Plugin ID 474043

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Tina is a headless content management system. Prior to 3.0.0, @tinacms/cli reads Git branch values from
 VERCEL_GIT_COMMIT_REF, GITHUB_BRANCH, or HEAD, incorporates the raw value into the API URL, and
 interpolates that URL into JavaScript string literals in packages/@tinacms/cli/src/next/codegen/index.ts
 and packages/@tinacms/cli/src/next/codegen/codegen/plugin.ts. A crafted Git-valid branch name containing a
 quote can terminate the generated string and inject an expression that executes when the generated client
 module is imported during a preview build. The injected code runs with the build process privileges and
 can read environment credentials, modify deployment artifacts, or make network requests. This issue is
 fixed in version 3.0.0. (CVE-2026-108259)

Solution

Update the @tinacms/cli library and its related packages to version 3.0.0 or later.

See Also

https://github.com/advisories/GHSA-pwhx-cvv3-qj5c

Plugin Details

Severity: High

ID: 474043

Version: Revision 1.1

Type: Local

Family: SCA Checks

Published: 10/10/2026

Updated: 10/10/2026

Risk Information

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: Medium

Base Score: 6.6

Temporal Score: 4.9

Vector: CVSS2#AV:N/AC:H/Au:S/C:C/I:C/A:N

CVSS Score Source: CVE-2026-108259

CVSS v3

Risk Factor: High

Base Score: 8.2

Temporal Score: 7.1

Vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 10/9/2026

Vulnerability Publication Date: 10/9/2026

Reference Information

CVE: CVE-2026-108259

cwe: CWE-94