CVE-2026-108260: TinaCMS XSS Vulnerability

CVE-2026-108260 Overview

CVE-2026-108260 is a stored cross-site scripting (XSS) vulnerability in TinaCMS, a headless content management system. The flaw resides in the tina-markdown element in packages/@tinacms/web-components/src/tina-markdown.js, which assigns a rich-text node.url value directly to an anchor href without validating the URL scheme. A content author can store a link using a script-capable scheme such as javascript:. When a visitor clicks the rendered link, attacker-controlled script executes in the site's origin. The issue affects versions prior to 0.2.1 and is fixed in 0.2.1. The weakness is classified as [CWE-79] Improper Neutralization of Input During Web Page Generation.

Critical Impact
Attackers with content-author access can inject scripts that run in the browser context of site visitors, including editors and administrators, potentially exposing TinaCMS admin credentials stored on the same origin.

Affected Products

TinaCMS @tinacms/web-components prior to 0.2.1
Sites rendering rich-text content through the tina-markdown element
TinaCMS deployments where editors or administrators share origin with public content

Discovery Timeline

2026-10-09 - CVE-2026-108260 published to NVD
2026-10-16 - Last updated in NVD database

Technical Details for CVE-2026-108260

Vulnerability Analysis

The tina-markdown web component renders rich-text nodes from TinaCMS content into HTML. For link nodes, the component writes the raw node.url string into the href attribute of an anchor element. The renderer performs no scheme allow-listing before output. An authenticated content author can save a link whose URL begins with javascript: followed by arbitrary JavaScript. The payload persists in the content store and renders as a clickable anchor on any page displaying the affected field.

When a visitor activates the link, the browser evaluates the script in the origin of the hosting site. The attacker's code gains access to same-origin storage, cookies not marked HttpOnly, and any application state exposed to the page. If the victim is a TinaCMS editor or administrator, the script may read credentials or session material that the TinaCMS admin stores on that origin, enabling account takeover.

Root Cause

The root cause is missing URL scheme validation on untrusted content before DOM insertion. The tina-markdown.js renderer trusted the author-supplied node.url field as a safe navigation target. Rich-text content in a CMS is user-controlled input and requires sanitization equivalent to any other HTML sink.

Attack Vector

Exploitation requires an account with content-authoring privileges and user interaction from a victim who clicks the malicious link. The attack is delivered over the network through normal content publishing workflows. Because the payload executes in the site origin, scope changes from the content system to any application sharing that origin, including the TinaCMS admin interface.

javascript

// Patch excerpt from packages/@tinacms/web-components/src/tina-markdown.js
+import { sanitizeUrl } from '@tinacms/mdx/sanitize-url';
 import DOMPurify from 'dompurify';

/**
 * The fix imports a sanitizeUrl helper that rejects dangerous URL
 * schemes (such as javascript:) before the value is written into the
 * anchor href, blocking stored XSS via rich-text link nodes.
 */

Source: GitHub Commit 5295e077

Detection Methods for CVE-2026-108260

Indicators of Compromise

Rich-text link nodes in the TinaCMS content store whose url field begins with javascript:, data:, or vbscript:.
Rendered anchor tags in production HTML with href values that do not start with http:, https:, mailto:, or a relative path.
Unexpected outbound requests or DOM modifications originating from pages that render the tina-markdown element.
Admin or editor session artifacts appearing in logs from unexpected IP addresses shortly after a user viewed content containing suspicious links.

Detection Strategies

Query the content database for rich-text nodes where the link URL does not match an allow-list of safe schemes.
Inspect the installed version of @tinacms/web-components across projects and flag any instance below 0.2.1.
Add Content Security Policy (CSP) violation reporting to surface inline script execution attempts in the site origin.

Monitoring Recommendations

Monitor browser-side telemetry and CSP reports for script-src violations on pages rendering TinaCMS content.
Audit TinaCMS editor and administrator sessions for anomalous authentication or token-refresh patterns following content views.
Track dependency manifests in continuous integration to alert on vulnerable @tinacms/web-components versions.

How to Mitigate CVE-2026-108260

Immediate Actions Required

Upgrade @tinacms/web-components to version 0.2.1 or later across all projects consuming the tina-markdown element.
Review existing rich-text content for stored links using javascript:, data:, or vbscript: schemes and remove or rewrite them.
Rotate TinaCMS admin credentials and session tokens if editor or administrator accounts may have viewed malicious links.
Restrict content-author access to trusted users until the upgrade is deployed.

Patch Information

The fix is published in @tinacms/web-components 0.2.1 and introduced by Pull Request #7523 with commit 5295e077. The patch imports a sanitizeUrl helper from @tinacms/mdx/sanitize-url and applies it to link and image URLs before they are written to the DOM. Full details are in GitHub Security Advisory GHSA-c42q-qvc3-j6vg.

Workarounds

Deploy a strict Content Security Policy that disallows inline script execution and javascript: URIs in anchor targets.
Serve the TinaCMS admin on a dedicated origin or subdomain isolated from public content rendering to limit same-origin credential exposure.
Add a pre-publish validation hook that rejects content with link URLs outside an allow-list of safe schemes.

bash

# Upgrade the affected package in a Node.js project
npm install @tinacms/web-components@0.2.1

# Verify the installed version
npm ls @tinacms/web-components