{"id":"EUVD-2025-204304","enisaUuid":"6708bbf1-9afb-3ba5-93ba-c92b92cd6e18","description":"Tina is a headless content management system. In tinacms prior to version 3.1.1, tinacms uses the gray-matter package in an insecure way allowing attackers that can control the content of the processed markdown files, e.g., blog posts, to execute arbitrary code. tinacms version 3.1.1, @tinacms/cli version 2.0.4, and @tinacms/graphql version 2.0.3 contain a fix for the issue.","datePublished":"Dec 18, 2025, 3:27:21 PM","dateUpdated":"Dec 18, 2025, 3:46:53 PM","baseScore":7.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P","references":"https://github.com/tinacms/tinacms/security/advisories/GHSA-529f-9qwm-9628\nhttps://github.com/tinacms/tinacms/commit/fa7c27abef968e3f3a3e7d564f282bc566087569\n","aliases":"CVE-2025-68278\nGHSA-529f-9qwm-9628\n","assigner":"GitHub_M","epss":0.48,"enisaIdProduct":[{"id":"462cbe93-d457-336e-97fc-8845768260dc","product":{"name":"tinacms","vendor":{"name":"tinacms"}},"product_version":"tinacms \u003c 3.1.1"},{"id":"bd3d843d-8e68-335c-bc44-7562a6493386","product":{"name":"tinacms","vendor":{"name":"tinacms"}},"product_version":"@tinacms/graphql \u003c 2.0.3"},{"id":"cbb66d52-9052-38c7-b8f2-257904bf6233","product":{"name":"tinacms","vendor":{"name":"tinacms"}},"product_version":"@tinacms/cli \u003c 2.0.4"}],"enisaIdVendor":[{"id":"5fad276b-5f81-3ffe-a811-006d62119b1b","vendor":{"name":"tinacms"}}],"enisaIdVulnerability":[{"id":"2a4dfb40-2604-3136-b098-8ee01051e3a2","vulnerability":{"id":"CVE-2025-68278","description":"Tina is a headless content management system. In tinacms prior to version 3.1.1, tinacms uses the gray-matter package in an insecure way allowing attackers that can control the content of the processed markdown files, e.g., blog posts, to execute arbitrary code. tinacms version 3.1.1, @tinacms/cli version 2.0.4, and @tinacms/graphql version 2.0.3 contain a fix for the issue.","datePublished":"Dec 18, 2025, 3:27:21 PM","dateUpdated":"Dec 18, 2025, 3:46:53 PM","status":"PUBLISHED","baseScore":7.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P","references":"https://github.com/tinacms/tinacms/security/advisories/GHSA-529f-9qwm-9628\nhttps://github.com/tinacms/tinacms/commit/fa7c27abef968e3f3a3e7d564f282bc566087569\n","enisa_id":"EUVD-2025-204304\n","assigner":"GitHub_M","epss":0.48,"dataProcessed":"Nov 4, 2026, 7:12:55 AM","vulnerabilityProduct":[{"id":"7f1cfd6f-6d0a-30cd-b009-93fcfd9757f6","product":{"name":"tinacms","vendor":{"name":"tinacms"}},"product_version":"tinacms \u003c 3.1.1"},{"id":"9539ef12-d240-3487-856b-51861f0be962","product":{"name":"tinacms","vendor":{"name":"tinacms"}},"product_version":"@tinacms/graphql \u003c 2.0.3"},{"id":"9a6fb2db-1777-35cb-bc10-c79473bf81de","product":{"name":"tinacms","vendor":{"name":"tinacms"}},"product_version":"@tinacms/cli \u003c 2.0.4"}],"vulnerabilityVendor":[{"id":"f247d12e-9589-3eea-a4b5-1f824842ef3a","vendor":{"name":"tinacms"}}]}},{"id":"c4fa31ec-aa69-3f02-b386-1bb06d812b60","vulnerability":{"id":"GHSA-529f-9qwm-9628","description":"tinacms is vulnerable to arbitrary code execution","datePublished":"Dec 18, 2025, 6:45:41 PM","dateUpdated":"Dec 18, 2025, 6:45:41 PM","baseScore":0.0,"references":"https://github.com/tinacms/tinacms/security/advisories/GHSA-529f-9qwm-9628\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-68278\nhttps://github.com/tinacms/tinacms/commit/fa7c27abef968e3f3a3e7d564f282bc566087569\nhttps://github.com/tinacms/tinacms\n","enisa_id":"EUVD-2025-204304\n","aliases":"CVE-2025-68278\nGHSA-529f-9qwm-9628\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 1:56:58 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}