TinaCMS CLI: Code injection via unescaped Git branch name in generated client
Summary
The Tina CLI (@tinacms/cli) writes the API URL, which includes the Git branch name, into generated JavaScript without proper escaping. A crafted branch name containing a quote can break out of the string literal and inject code. The injected code runs when the generated client is imported during a preview build, with the build process privileges, and can read environment credentials, modify deployment artifacts or make network requests.
Affected
- @tinacms/cli before 3.0.0
- tinacms before 3.0.0 (per the official CVE record)
Fixed in
- Upgrade @tinacms/cli to version 3.0.0 or later
Workaround
Unknown.
Exploitation
- The CISA SSVC assessment lists exploitation as PoC, not automatable.
- No active exploitation in the wild has been reported.
- Public exploit availability could not be confirmed.
Our recommendation
- Upgrade @tinacms/cli to version 3.0.0 or later and check lockfiles for older versions.
- Until the upgrade is done, do not run preview or CI builds of untrusted branches or pull requests while secrets are available.
- Restrict builds of fork and external pull requests.
- Monitor build logs and rotate deployment tokens if suspicious builds are found.
- Note: the attacker needs at least low privileges (for example repository write access or the ability to create a branch), which may be cheap on public repositories.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-pwhx-cvv3-qj5c github.com
- Fix commit d030d414 github.com
- Pull request #7526 github.com
- @tinacms/cli 3.0.0 release github.com
- GitLab advisory CVE-2026-108259 advisories.gitlab.com
- VulDB entry 416020 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 16:43.
Original description (NVD)
Tina is a headless content management system. Prior to 3.0.0, @tinacms/cli reads Git branch values from VERCEL_GIT_COMMIT_REF, GITHUB_BRANCH, or HEAD, incorporates the raw value into the API URL, and interpolates that URL into JavaScript string literals in packages/@tinacms/cli/src/next/codegen/index.ts and packages/@tinacms/cli/src/next/codegen/codegen/plugin.ts. A crafted Git-valid branch name containing a quote can terminate the generated string and inject an expression that executes when the generated client module is imported during a preview build. The injected code runs with the build process privileges and can read environment credentials, modify deployment artifacts, or make network requests. This issue is fixed in version 3.0.0.
NVD references (5)
- https://github.com/tinacms/tinacms/commit/d030d414d39e15de79bf36e4c728d57205e71dde
- https://github.com/tinacms/tinacms/pull/7526
- https://github.com/tinacms/tinacms/releases/tag/@tinacms/cli@3.0.0
- https://github.com/tinacms/tinacms/security/advisories/GHSA-pwhx-cvv3-qj5c
- https://github.com/tinacms/tinacms/security/advisories/GHSA-pwhx-cvv3-qj5c
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.