CVE-2026-108259

Tina is a headless content management system. Prior to 3.0.0, @tinacms/cli reads Git branch values from VERCEL_GIT_COMMIT_REF, GITHUB_BRANCH, or HEAD, incorporates the raw value into the API URL, and interpolates that URL into JavaScript string literals in packages/@tinacms/cli/src/next/codegen/index.ts and packages/@tinacms/cli/src/next/codegen/codegen/plugin.ts. A crafted Git-valid branch name containing a quote can terminate the generated string and inject an expression that executes when the generated client module is imported during a preview build. The injected code runs with the build process privileges and can read environment credentials, modify deployment artifacts, or make network requests. This issue is fixed in version 3.0.0.

• CWE-94

• https://github.com/tinacms/tinacms/commit/d030d414d39e15de79bf36e4c728d57205e71dde
• https://github.com/tinacms/tinacms/pull/7526
• https://github.com/tinacms/tinacms/releases/tag/@tinacms/cli@3.0.0
• https://github.com/tinacms/tinacms/security/advisories/GHSA-pwhx-cvv3-qj5c
• https://github.com/tinacms/tinacms/security/advisories/GHSA-pwhx-cvv3-qj5c

Published

Oct 9, 2026

Last Modified

Oct 16, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-10821The Yoast SEO Premium WordPress plugin before 27.6.1 does no…6.6
• CVE-2026-10822If BIND encounters a particular invalid data structure in a …6.5
• CVE-2026-10823The YMC Filter WordPress plugin before 3.11.3 does not prope…7.5
• CVE-2026-10824The Masteriyo LMS WordPress plugin before 2.2.1 does not pe…6.5
• CVE-2026-10825A denial-of-service vulnerability exists in the WebSocket AP…7.1
• CVE-2026-108258Shiny for Python is a framework for building interactive web…6.9
• CVE-2026-108260Tina is a headless content management system. Prior to 0.2.1…7.6
• CVE-2026-108261Tina is a headless content management system. Prior to tinac…9.3
• CVE-2026-108263Astron Agent is an agentic workflow platform for building an…9.9
• CVE-2026-108264Wizarr is an advanced user invitation and management system …9.1
• CVE-2026-108265Enclave OS Mini is a Rust-based runtime for confidential app…9.1
• CVE-2026-108266Privasys rustls is a maintained fork of the rustls TLS libra…9.1