CVE-2026-55660

Tina is a headless content management system. In versions prior to @tinacms/app 2.5.6 and tinacms 3.9.3, cross-origin postMessage handlers and a rich-text URL-sanitization bypass enable stored XSS and session takeover. The library registers window message listeners — the useTina overlay handler, the OAuth authentication popup handler, and the admin↔preview iframe GraphQL reducer — that act on event.data without verifying event.origin or event.source and post messages using non-specific target origins, while insufficient URL sanitization in rich-text content allows malicious URLs to persist and execute. A page the victim visits (or a window in an opener/iframe relationship with a Tina admin) can forge messages to drive the editor, inject preview content, or observe/forge the OAuth popup channel to take over an authenticated editing session. This issue has been fixed in versions @tinacms/app 2.5.6 and tinacms 3.9.3.

• CWE-79
• CWE-346
• CWE-601
• CWE-940

• https://github.com/tinacms/tinacms/pull/7056
• https://github.com/tinacms/tinacms/security/advisories/GHSA-g5qx-h5f3-mp2f

Published

Jul 1, 2026

Last Modified

Jul 2, 2026

Status

Deferred

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-55652Wekan is open source kanban built with Meteor. Prior to 9.46…9.8
• CVE-2026-55653A flaw was found in OpenSSH. A malicious SSH server can expl…6.5
• CVE-2026-55654A flaw was found in OpenSSH. This vulnerability, a heap out-…3.7
• CVE-2026-55655A flaw was found in OpenSSH. A local unprivileged attacker o…6.1
• CVE-2026-55659Grist is spreadsheet software using Python as its formula la…7.7
• CVE-2026-5566A vulnerability was detected in UTT HiPER 1250GW up to 3.2.7…8.8
• CVE-2026-55661Tina is a headless content management system. In versions pr…4.8
• CVE-2026-55664Grist is spreadsheet software using Python as its formula la…4.3
• CVE-2026-55665Grist is spreadsheet software using Python as its formula la…8.5
• CVE-2026-55666Rocket.Chat is an open-source, secure, fully customizable co…9.3
• CVE-2026-55667File Browser is a file managing interface for uploading, del…8.2
• CVE-2026-55668File Browser provides a web file managing interface. Prior t…6.3