TinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragment

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-108261 · Microsoft / collected KEV context

EUVD-2026-95990

GHSA-x34j-47hf-4xg7

cve-program · CVE-2026-108261

• https://github.com/tinacms/tinacms/security/advisories/GHSA-x34j-47hf-4xg7
• https://github.com/tinacms/tinacms/pull/7522
• https://github.com/tinacms/tinacms/commit/b57dbf4b56201aef15cd92caa49fd12ab96bbecf
• https://github.com/tinacms/tinacms/releases/tag/@tinacms/[email protected]
• https://github.com/tinacms/tinacms/releases/tag/[email protected]

euvd · EUVD-2026-95990

• https://github.com/tinacms/tinacms/security/advisories/GHSA-x34j-47hf-4xg7
• https://github.com/tinacms/tinacms/pull/7522
• https://github.com/tinacms/tinacms/commit/b57dbf4b56201aef15cd92caa49fd12ab96bbecf
• https://github.com/tinacms/tinacms/releases/tag/@tinacms/[email protected]
• https://github.com/tinacms/tinacms/releases/tag/[email protected]

nvd · CVE-2026-108261

• https://github.com/tinacms/tinacms/commit/b57dbf4b56201aef15cd92caa49fd12ab96bbecf
• https://github.com/tinacms/tinacms/pull/7522
• https://github.com/tinacms/tinacms/releases/tag/@tinacms/[email protected]
• https://github.com/tinacms/tinacms/releases/tag/[email protected]
• https://github.com/tinacms/tinacms/security/advisories/GHSA-x34j-47hf-4xg7

osv · GHSA-x34j-47hf-4xg7

• https://github.com/tinacms/tinacms/security/advisories/GHSA-x34j-47hf-4xg7
• https://github.com/tinacms/tinacms/pull/7522
• https://github.com/tinacms/tinacms/commit/b57dbf4b56201aef15cd92caa49fd12ab96bbecf
• https://github.com/tinacms/tinacms
• https://github.com/tinacms/tinacms/releases/tag/@tinacms/[email protected]
• https://github.com/tinacms/tinacms/releases/tag/[email protected]

No related operational record is retained in the current change model.