@tinacms/cli: Remote Code Execution via Forestry migration — unsanitised __TINA_INTERNAL__ marker in user-controlled YAML labels

Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.

CVE-2026-54074 · CVE overview and exploitation status

EUVD-2026-41142

GHSA-4936-9hrh-qqpw

cve-program · CVE-2026-54074

• https://github.com/tinacms/tinacms/security/advisories/GHSA-4936-9hrh-qqpw

euvd · EUVD-2026-41142

• https://github.com/tinacms/tinacms/security/advisories/GHSA-4936-9hrh-qqpw

nvd · CVE-2026-54074

• https://github.com/tinacms/tinacms/security/advisories/GHSA-4936-9hrh-qqpw

osv · GHSA-4936-9hrh-qqpw

• https://github.com/tinacms/tinacms/security/advisories/GHSA-4936-9hrh-qqpw
• https://github.com/tinacms/tinacms/pull/7006
• https://github.com/tinacms/tinacms/commit/77665ae73dd4f9563d339535e76fa811a8abdfbb
• https://github.com/tinacms/tinacms
• https://github.com/tinacms/tinacms/releases/tag/@tinacms/[email protected]

No related changes are available here.