TinaCMS CLI high-severity injection flaw fixed in version 3.0.0

TinaCMS has released version 3.0.0 of its @tinacms/cli package to address a high-severity code injection vulnerability that allows attackers to execute arbitrary JavaScript during the build process. The flaw, tracked as CVE-2026-108259 with a CVSS score of 8.2, affects all versions of the command-line interface prior to 3.0.0.

The vulnerability arises because the tool reads Git branch values from environment variables such as VERCEL_GIT_COMMIT_REF, GITHUB_BRANCH, or HEAD and incorporates those raw values directly into API URLs. According to the National Vulnerability Database and GitHub advisory GHSA-pwhx-cvv3-qj5c, the system then interpolates these URLs into JavaScript string literals within the generated client module. Because the branch names are not escaped or encoded, a crafted branch name containing a quote character can terminate the string literal and inject executable code.

Context and Background

The root cause lies in the code generation pipeline of the @tinacms/cli package. Specifically, the source code in packages/@tinacms/cli/src/cmds/init/templates/config.ts reads the branch information into a configuration object. This data is then processed by the _createApiUrl() function in packages/@tinacms/cli/src/next/codegen/index.ts, which concatenates the raw branch name into the API URL without applying encodeURIComponent or similar sanitization.

The unsanitized URL is subsequently inserted into template strings in both index.ts and packages/@tinacms/cli/src/next/codegen/codegen/plugin.ts. The GitHub advisory notes that the template uses syntax such as url: '${apiURL}', leaving the input vulnerable to injection. An attacker can create a Git-valid branch name, such as x'+(globalThis.__TINA_PROBE='hit')+' which passes standard Git reference format checks. When the codegen process runs, the single quote in the branch name closes the URL string, allowing the subsequent JavaScript expression to be parsed and executed when the consumer build imports the generated client module.

Who is Affected

This issue impacts developers using @tinacms/cli versions 2.7.0 and earlier. The vulnerability is classified under CWE-94 for Improper Control of Generation of Code ('Code Injection'). Because the injected code runs with the privileges of the build process, an attacker who can influence the Git branch name—such as through a pull request or a compromised CI/CD pipeline step—can potentially read environment credentials, modify deployment artifacts, or make unauthorized network requests. The fix is available in version 3.0.0 of the @tinacms/cli package.

What should you do?

Users of TinaCMS should verify their current version of @tinacms/cli and update to 3.0.0 or later to mitigate this risk. Until the update is applied, teams should review their CI/CD pipelines to ensure that branch names cannot be manipulated by untrusted actors. Monitoring build logs for unexpected JavaScript execution or network requests during the preview build phase can also help detect exploitation attempts.