{"id":"EUVD-2026-95989","enisaUuid":"581d4cf5-10ed-3439-a56e-47b37f60c020","description":"Tina is a headless content management system. Prior to 0.2.1, the tina-markdown element in packages/@tinacms/web-components/src/tina-markdown.js assigns a rich-text node.url value directly to an anchor href without validating the URL scheme. A content author can store a link using a script-capable scheme, and a visitor who clicks the rendered link executes attacker-controlled script in the site\u0027s origin. The script can access same-origin application data and, when the visitor is an editor or administrator, may expose credentials stored by the TinaCMS admin on that origin. This issue is fixed in version 0.2.1.","datePublished":"Oct 9, 2026, 8:40:37 PM","dateUpdated":"Oct 13, 2026, 3:17:14 PM","baseScore":7.6,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N","references":"https://github.com/tinacms/tinacms/security/advisories/GHSA-c42q-qvc3-j6vg\nhttps://github.com/tinacms/tinacms/pull/7523\nhttps://github.com/tinacms/tinacms/commit/5295e077f0d279c35686a0e481a15e33a4877e3b\nhttps://github.com/tinacms/tinacms/releases/tag/@tinacms/web-components@0.2.1\n","aliases":"CVE-2026-108260\nGHSA-c42q-qvc3-j6vg\n","assigner":"GitHub_M","epss":0.25,"enisaIdProduct":[{"id":"2265f509-34fa-3668-9150-e0c41ef9bc3b","product":{"name":"web-components","vendor":{"name":"@tinacms"}},"product_version":"\u003c 0.2.1"},{"id":"c2852d1e-8f78-3659-baf7-e9233ea3fa0f","product":{"name":"tinacms","vendor":{"name":"tinacms"}},"product_version":"\u003c 3.14.0"}],"enisaIdVendor":[{"id":"0d7cd083-923c-33b3-acad-4d34a4883300","vendor":{"name":"tinacms"}},{"id":"6bdcfb8c-a281-366f-8d5a-0e03a7172752","vendor":{"name":"@tinacms"}}],"enisaIdVulnerability":[{"id":"ee5712dd-2a8d-3390-8d6b-38540a5eee33","vulnerability":{"id":"GHSA-c42q-qvc3-j6vg","description":"@tinacms/web-components: `tina-markdown` writes rich-text link URLs into `href` without scheme validation, allowing stored XSS","datePublished":"Oct 9, 2026, 8:56:45 PM","dateUpdated":"Oct 9, 2026, 8:56:45 PM","baseScore":0.0,"references":"https://github.com/tinacms/tinacms/security/advisories/GHSA-c42q-qvc3-j6vg\nhttps://github.com/tinacms/tinacms/pull/7523\nhttps://github.com/tinacms/tinacms/commit/5295e077f0d279c35686a0e481a15e33a4877e3b\nhttps://github.com/tinacms/tinacms\nhttps://github.com/tinacms/tinacms/releases/tag/@tinacms/web-components@0.2.1\n","enisa_id":"EUVD-2026-95989\n","aliases":"GHSA-c42q-qvc3-j6vg\nCVE-2026-108260\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:07:07 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"fa6cc0a3-3d81-3b37-b6c7-daa7b01dd9ec","vulnerability":{"id":"CVE-2026-108260","description":"Tina is a headless content management system. Prior to 0.2.1, the tina-markdown element in packages/@tinacms/web-components/src/tina-markdown.js assigns a rich-text node.url value directly to an anchor href without validating the URL scheme. A content author can store a link using a script-capable scheme, and a visitor who clicks the rendered link executes attacker-controlled script in the site\u0027s origin. The script can access same-origin application data and, when the visitor is an editor or administrator, may expose credentials stored by the TinaCMS admin on that origin. This issue is fixed in version 0.2.1.","datePublished":"Oct 9, 2026, 8:40:37 PM","dateUpdated":"Oct 13, 2026, 3:17:14 PM","status":"PUBLISHED","baseScore":7.6,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N","references":"https://github.com/tinacms/tinacms/security/advisories/GHSA-c42q-qvc3-j6vg\nhttps://github.com/tinacms/tinacms/pull/7523\nhttps://github.com/tinacms/tinacms/commit/5295e077f0d279c35686a0e481a15e33a4877e3b\nhttps://github.com/tinacms/tinacms/releases/tag/@tinacms/web-components@0.2.1\n","enisa_id":"EUVD-2026-95989\n","assigner":"GitHub_M","epss":0.25,"dataProcessed":"Nov 6, 2026, 7:17:53 AM","vulnerabilityProduct":[{"id":"06761961-4045-33ed-b11f-40192f2b00e3","product":{"name":"tinacms","vendor":{"name":"tinacms"}},"product_version":"\u003c 3.14.0"},{"id":"4d2bba00-6a04-3407-96a5-ba326e6a6b7f","product":{"name":"web-components","vendor":{"name":"@tinacms"}},"product_version":"\u003c 0.2.1"}],"vulnerabilityVendor":[{"id":"5283ea22-c0a5-3b6b-a51d-02a70d7fa185","vendor":{"name":"tinacms"}},{"id":"d48c8ee2-86d2-3061-9add-b710d11292f7","vendor":{"name":"@tinacms"}}]}}],"enisaIdAdvisory":[]}