CVE-2026-54074

Tina is a headless content management system. @tinacms/cli versions prior to 2.4.3 contain a Remote Code Execution vulnerability in the Forestry-to-Tina migration command. The internal helper addVariablesToCode unquotes any value matching the marker "__TINA_INTERNAL__:::(.*?):::" inside the stringified collection JSON. User-supplied label and name fields from .forestry/**/*.yml are placed into that JSON without any sanitisation. An attacker who controls a Forestry-style project can therefore inject arbitrary JavaScript into the generated tina/templates.{ts,js} file. The injected code is written at module top level, so it executes the moment the developer runs tinacms dev or tinacms build, with the developer's privileges. This issue has been fixed in version 2.4.3.

• CWE-94

• https://github.com/tinacms/tinacms/security/advisories/GHSA-4936-9hrh-qqpw
• https://github.com/tinacms/tinacms/security/advisories/GHSA-4936-9hrh-qqpw

Published

Jul 1, 2026

Last Modified

Jul 2, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-54066SiYuan is an open-source personal knowledge management syste…7.5
• CVE-2026-54067SiYuan is an open-source personal knowledge management syste…9.9
• CVE-2026-54068SiYuan is an open-source personal knowledge management syste…5.9
• CVE-2026-54069SiYuan is an open-source personal knowledge management syste…9.2
• CVE-2026-5407SMB2 protocol dissector infinite loop in Wireshark 4.6.0 to …5.5
• CVE-2026-54070SiYuan is an open-source personal knowledge management syste…7.1
• CVE-2026-54078veraPDF validation model is an implementation of the veraPDF…8.7
• CVE-2026-54079veraPDF validation provides PDF/A and PDF/UA validation, fea…8.7
• CVE-2026-5408BT-DHT protocol dissector crash in Wireshark 4.6.0 to 4.6.4 …5.5
• CVE-2026-54080veraPDF PDF parser is a PDF parser for veraPDF. Prior to 1.3…6.9
• CVE-2026-54081veraPDF PDF parser is a PDF parser for veraPDF. Prior to 1.3…6.9
• CVE-2026-54082veraPDF validation model is an implementation of the veraPDF…6.5