CVE-2026-55661 Overview
CVE-2026-55661 is a stored cross-site scripting (XSS) vulnerability in Tina, a headless content management system. The flaw exists in @tinacms/mdx versions prior to 2.1.7 and tinacms versions prior to 3.9.3. Rich-text parsing and the default link and image renderers fail to sanitize the url field on Slate link and image nodes. Content containing javascript: or data:text/html URLs — including case-variant, whitespace-padded, and control-character-obfuscated forms — is rendered directly into href and src attributes. The payload executes when editors or site visitors view the affected content.
Critical Impact
Any user with rich-text authoring permission, including lower-privileged editors or automated content imports, can achieve stored XSS against editors and site viewers.
Affected Products
- @tinacms/mdx versions prior to 2.1.7
- tinacms versions prior to 3.9.3
- Sites and editor interfaces rendering Tina rich-text content with default link/image renderers
Discovery Timeline
- 2026-07-01 - CVE-2026-55661 published to NVD
- 2026-07-01 - Last updated in NVD database
Technical Details for CVE-2026-55661
Vulnerability Analysis
The vulnerability is a stored cross-site scripting flaw classified under [CWE-79]. Tina's rich-text pipeline serializes and deserializes Slate document nodes that include link and image elements. Each element carries a url property intended for href or src output. The default renderers pass this value into the DOM without validating the URL scheme.
Attackers can supply URLs using dangerous schemes such as javascript: or data:text/html. The parser accepts obfuscated variants, including mixed-case schemes, leading or embedded whitespace, and control-character padding. These bypass naïve string comparisons that some downstream consumers might expect the CMS to enforce.
When a browser renders the resulting markup, clicking a poisoned link or loading a poisoned image reference executes attacker-controlled script in the origin of the editor or public site. This grants access to authenticated sessions, editor tokens, and any content managed through the CMS.
Root Cause
The root cause is missing input sanitization on the url field of Slate link and image nodes during rich-text parsing and rendering. The default renderers do not enforce an allow-list of safe URL schemes such as http, https, or mailto.
Attack Vector
A lower-privileged editor, or an automated pipeline importing external content, submits rich-text content containing a crafted URL. The content is stored through normal CMS workflows. When another editor previews the entry, or a public visitor loads the rendered page, the browser evaluates the malicious scheme and executes the payload in the site origin. The vulnerability requires user interaction, such as viewing or clicking the rendered element. See the GitHub Security Advisory for technical details.
Detection Methods for CVE-2026-55661
Indicators of Compromise
- Stored rich-text content whose link or image url field begins with javascript:, data:text/html, or case-variant and whitespace-padded forms of these schemes
- Unexpected outbound requests or token exfiltration originating from editor sessions after previewing user-submitted content
- New or modified Slate nodes authored by low-privilege editor accounts containing non-http(s) URL schemes
Detection Strategies
- Scan the content repository and database for rich-text records whose serialized link or image nodes contain URL schemes outside an allow-list of http, https, and mailto
- Review Git history and content import logs for pull requests or automated jobs introducing suspicious url values into Markdown or MDX files
- Enable Content Security Policy (CSP) reporting to capture inline script execution attempts against editor and production origins
Monitoring Recommendations
- Log and alert on editor account activity that creates or edits link and image nodes with non-standard URL schemes
- Monitor CSP violation reports for script-src and img-src breaches on pages rendering Tina content
- Track version pinning of @tinacms/mdx and tinacms across build pipelines to confirm patched releases are deployed
How to Mitigate CVE-2026-55661
Immediate Actions Required
- Upgrade @tinacms/mdx to version 2.1.7 or later and tinacms to version 3.9.3 or later
- Audit existing rich-text content for link and image nodes containing javascript: or data:text/html URLs and remove or rewrite them
- Restrict rich-text authoring permissions to trusted editors until patched builds are deployed
Patch Information
The issue is fixed in @tinacms/mdx2.1.7 and tinacms3.9.3. Patched versions sanitize the url field on Slate link and image nodes and reject dangerous URL schemes, including case-variant, whitespace-padded, and control-character-obfuscated forms. See the upstream fix in the GitHub Pull Request.
Workarounds
- Override the default link and image renderers to enforce an allow-list of URL schemes limited to http, https, and mailto
- Deploy a strict Content Security Policy that disallows inline script execution and blocks data: URLs in script-src and img-src directives
- Sanitize imported or externally sourced Markdown and MDX content before ingestion into the CMS
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
