{"id":"EUVD-2026-95987","enisaUuid":"06d1b81c-b8b4-3fea-8452-953c78928314","description":"Tina is a headless content management system. Prior to 3.0.0, @tinacms/cli reads Git branch values from VERCEL_GIT_COMMIT_REF, GITHUB_BRANCH, or HEAD, incorporates the raw value into the API URL, and interpolates that URL into JavaScript string literals in packages/@tinacms/cli/src/next/codegen/index.ts and packages/@tinacms/cli/src/next/codegen/codegen/plugin.ts. A crafted Git-valid branch name containing a quote can terminate the generated string and inject an expression that executes when the generated client module is imported during a preview build. The injected code runs with the build process privileges and can read environment credentials, modify deployment artifacts, or make network requests. This issue is fixed in version 3.0.0.","datePublished":"Oct 9, 2026, 8:36:41 PM","dateUpdated":"Oct 14, 2026, 2:12:59 AM","baseScore":8.2,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N","references":"https://github.com/tinacms/tinacms/security/advisories/GHSA-pwhx-cvv3-qj5c\nhttps://github.com/tinacms/tinacms/pull/7526\nhttps://github.com/tinacms/tinacms/commit/d030d414d39e15de79bf36e4c728d57205e71dde\nhttps://github.com/tinacms/tinacms/releases/tag/@tinacms/cli@3.0.0\n","aliases":"CVE-2026-108259\nGHSA-pwhx-cvv3-qj5c\n","assigner":"GitHub_M","epss":0.33,"enisaIdProduct":[{"id":"bfef42cc-f2a0-324e-a6c5-cca94c3925b6","product":{"name":"cli","vendor":{"name":"cli"}},"product_version":"\u003c 3.0.0"},{"id":"cbe00262-6238-3296-ba10-bccd1b404b09","product":{"name":"tinacms","vendor":{"name":"tinacms"}},"product_version":"\u003c 3.0.0"}],"enisaIdVendor":[{"id":"0372562b-7f4a-3366-9abc-f0433e9c80e5","vendor":{"name":"@tinacms"}},{"id":"28a738d6-cae6-339e-8026-5b1a04aad47f","vendor":{"name":"tinacms"}}],"enisaIdVulnerability":[{"id":"262f5b3f-1873-3d54-be84-eca6192a8991","vulnerability":{"id":"CVE-2026-108259","description":"Tina is a headless content management system. Prior to 3.0.0, @tinacms/cli reads Git branch values from VERCEL_GIT_COMMIT_REF, GITHUB_BRANCH, or HEAD, incorporates the raw value into the API URL, and interpolates that URL into JavaScript string literals in packages/@tinacms/cli/src/next/codegen/index.ts and packages/@tinacms/cli/src/next/codegen/codegen/plugin.ts. A crafted Git-valid branch name containing a quote can terminate the generated string and inject an expression that executes when the generated client module is imported during a preview build. The injected code runs with the build process privileges and can read environment credentials, modify deployment artifacts, or make network requests. This issue is fixed in version 3.0.0.","datePublished":"Oct 9, 2026, 8:36:41 PM","dateUpdated":"Oct 14, 2026, 2:12:59 AM","status":"PUBLISHED","baseScore":8.2,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N","references":"https://github.com/tinacms/tinacms/security/advisories/GHSA-pwhx-cvv3-qj5c\nhttps://github.com/tinacms/tinacms/pull/7526\nhttps://github.com/tinacms/tinacms/commit/d030d414d39e15de79bf36e4c728d57205e71dde\nhttps://github.com/tinacms/tinacms/releases/tag/@tinacms/cli@3.0.0\n","enisa_id":"EUVD-2026-95987\n","assigner":"GitHub_M","epss":0.33,"dataProcessed":"Nov 1, 2026, 4:05:05 AM","vulnerabilityProduct":[{"id":"69bf7e63-7e85-3e15-a935-a99accc0dfd8","product":{"name":"tinacms","vendor":{"name":"tinacms"}},"product_version":"\u003c 3.0.0"},{"id":"a077809f-84ab-3e21-ae90-745bf60e06a5","product":{"name":"cli","vendor":{"name":"cli"}},"product_version":"\u003c 3.0.0"}],"vulnerabilityVendor":[{"id":"0fb71b3f-b92d-395c-9a30-ed4450dc9c95","vendor":{"name":"tinacms"}},{"id":"2ef6d9d9-5ba0-3ec5-ab46-1dd0249f19a6","vendor":{"name":"@tinacms"}}]}},{"id":"f01d2934-8532-39ef-9267-9230806d20ee","vulnerability":{"id":"GHSA-pwhx-cvv3-qj5c","description":"Tina: Code injection via unescaped Git branch name in generated client source","datePublished":"Oct 9, 2026, 8:56:52 PM","dateUpdated":"Oct 9, 2026, 8:56:52 PM","baseScore":0.0,"references":"https://github.com/tinacms/tinacms/security/advisories/GHSA-pwhx-cvv3-qj5c\nhttps://github.com/tinacms/tinacms/pull/7526\nhttps://github.com/tinacms/tinacms/commit/d030d414d39e15de79bf36e4c728d57205e71dde\nhttps://github.com/tinacms/tinacms\nhttps://github.com/tinacms/tinacms/releases/tag/@tinacms/cli@3.0.0\n","enisa_id":"EUVD-2026-95987\n","aliases":"CVE-2026-108259\nGHSA-pwhx-cvv3-qj5c\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:07:07 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}