CVE-2023-25164

Tinacms is a Git-backed headless content management system with support for visual editing. Sites being built with @tinacms/cli >= 1.0.0 && < 1.0.9 which store sensitive values in the process.env variable are impacted. These values will be added in plaintext to the index.js file. If you're on a version prior to 1.0.0 this vulnerability does not affect you. If you are affected and your Tina-enabled website has sensitive credentials stored as environment variables (eg. Algolia API keys) you should rotate those keys immediately. This issue has been patched in @tinacms/cli@1.0.9. Users are advised to upgrade. There are no known workarounds for this issue.

• CWE-200
• CWE-532

• https://github.com/tinacms/tinacms/pull/3584Issue Tracking, Patch
• https://github.com/tinacms/tinacms/security/advisories/GHSA-pc2q-jcxq-rjrrVendor Advisory
• https://github.com/tinacms/tinacms/pull/3584Issue Tracking, Patch
• https://github.com/tinacms/tinacms/security/advisories/GHSA-pc2q-jcxq-rjrrVendor Advisory

Published

Feb 8, 2023

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-25159Nextcloud Server is the file server software for Nextcloud, …5.3
• CVE-2023-2516Cross-site Scripting (XSS) - Stored in GitHub repository nil…5.4
• CVE-2023-25160Nextcloud Mail is an email app for the Nextcloud home server…5.3
• CVE-2023-25161Nextcloud Server is the file server software for Nextcloud, …5.3
• CVE-2023-25162Nextcloud Server is the file server software for Nextcloud, …5.3
• CVE-2023-25163Argo CD is a declarative, GitOps continuous delivery tool fo…6.5
• CVE-2023-25165Helm is a tool that streamlines installing and managing Kube…4.3
• CVE-2023-25166formula is a math and string formula parser. In versions pri…6.5
• CVE-2023-25167Discourse is an open source discussion platform. In affected…5.7
• CVE-2023-25168Wings is Pterodactyl's server control plane. This vulnerabil…8.2
• CVE-2023-25169discourse-yearly-review is a discourse plugin which publishe…5.3
• CVE-2023-2517The Metform Elementor Contact Form Builder plugin for WordPr…4.3