CVE-2026-55660 Overview
CVE-2026-55660 affects Tina, a headless content management system, in versions prior to @tinacms/app 2.5.6 and tinacms 3.9.3. The vulnerability combines unsafe cross-origin postMessage handling with a rich-text URL sanitization bypass. Attackers can trigger stored cross-site scripting (XSS) [CWE-79] and hijack authenticated editor sessions. A page the victim visits, or a window in an opener or iframe relationship with a Tina admin, can forge messages to drive the editor, inject preview content, or observe the OAuth popup channel. Maintainers fixed the issue in @tinacms/app 2.5.6 and tinacms 3.9.3.
Critical Impact
Attackers can achieve stored XSS in the Tina admin interface and take over authenticated editing sessions through forged cross-origin messages.
Affected Products
- Tina CMS tinacms versions prior to 3.9.3
- Tina CMS @tinacms/app versions prior to 2.5.6
- Applications embedding the Tina admin↔preview iframe or OAuth popup flows
Discovery Timeline
- 2026-07-01 - CVE-2026-55660 published to NVD
- 2026-07-02 - Last updated in NVD database
Technical Details for CVE-2026-55660
Vulnerability Analysis
The vulnerability stems from multiple window.postMessage listeners registered by Tina that act on event.data without validating event.origin or event.source. The affected handlers include the useTina overlay handler, the OAuth authentication popup handler, and the admin↔preview iframe GraphQL reducer. These handlers also post messages using non-specific target origins, exposing message contents to any window in an opener or frame relationship.
A second flaw resides in rich-text content processing. Insufficient URL sanitization allows malicious URLs, including JavaScript protocol payloads, to persist in stored content and execute when rendered. Combined, these weaknesses produce both stored XSS and session takeover primitives inside the editing surface.
Root Cause
The root cause is missing origin validation on inbound postMessage events paired with permissive target origins on outbound messages. The rich-text pipeline compounds the issue by failing to strip dangerous URL schemes before persisting content. Both weaknesses fall under improper neutralization of input during web page generation [CWE-79].
Attack Vector
An attacker lures an authenticated Tina editor to a malicious page, or leverages an existing opener or iframe relationship with the Tina admin. The attacker page dispatches crafted messages to the admin window to drive editor actions, inject preview content, or intercept OAuth popup traffic. Alternatively, an attacker with content submission privileges plants a malicious URL in rich-text fields that executes when other users load the page. Successful exploitation yields code execution in the admin origin and takeover of the authenticated editing session.
No verified public exploit code is available. See the GitHub Security Advisory GHSA-g5qx-h5f3-mp2f for maintainer analysis.
Detection Methods for CVE-2026-55660
Indicators of Compromise
- Unexpected javascript: or data: URLs stored in Tina rich-text content fields
- Editor sessions that perform content changes without corresponding user input events
- OAuth popup traffic originating from or targeting unexpected origins
Detection Strategies
- Audit stored Tina content for URL schemes outside an allowlist of http, https, and mailto
- Review browser console and network logs for postMessage traffic between the admin and unknown origins
- Compare deployed Tina package versions against fixed releases @tinacms/app 2.5.6 and tinacms 3.9.3
Monitoring Recommendations
- Log and alert on OAuth token issuance events that do not correlate with a user-initiated login
- Monitor Content Security Policy (CSP) violation reports for inline script execution in the admin origin
- Track anomalous editor API calls such as bulk content edits from a single session
How to Mitigate CVE-2026-55660
Immediate Actions Required
- Upgrade @tinacms/app to 2.5.6 or later and tinacms to 3.9.3 or later
- Rotate OAuth client secrets and invalidate active editor sessions after patching
- Review recent rich-text content for injected URLs and remove malicious entries
Patch Information
The maintainers released fixes in @tinacms/app 2.5.6 and tinacms 3.9.3. The patches add origin verification to inbound message handlers, restrict target origins on outbound messages, and tighten URL sanitization in rich-text content. Review the GitHub Pull Request 7056 for implementation details.
Workarounds
- Restrict access to the Tina admin interface behind a VPN or IP allowlist until patching completes
- Enforce a strict Content Security Policy that blocks inline scripts and limits frame-ancestors
- Instruct editors to avoid opening untrusted links while an admin session is active
# Update Tina packages to patched versions
npm install @tinacms/app@2.5.6 tinacms@3.9.3
# Verify installed versions
npm list @tinacms/app tinacms
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
