CVE-2026-108261
TinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragment
The TinaCMS admin builds its preview <iframe src> from the /~/* hash-router splat without checking that the value stays same-origin. A fragment with a doubled slash (#/~//attacker.example/p) becomes the protocol-relative URL //attacker.example/p, so the admin frames an external site.
- No known exploitation
- Severity
- Critical, CVSS 9.3 (v3.1)
- EPSS
- 0.16% chance of exploitation in 30 days (EPSS, as of Oct 23, 2026)
- Affected packages
- tinacms (npm) <= 3.13.0, fixed in 3.14.0 · GHSA-x34j-47hf-4xg7
- @tinacms/app (npm) <= 2.5.13, fixed in 2.5.14 · GHSA-x34j-47hf-4xg7