CVE-2026-55661

Tina is a headless content management system. In versions prior to @tinacms/mdx 2.1.7 and tinacms 3.9.3, rich-text parsing and the default link/image renderers did not sanitize the url field on Slate link/image nodes. Content containing javascript: or data:text/html URLs — including case-variant, whitespace-padded, and control-character-obfuscated forms — is rendered into href/src and executes when the content is viewed. Any actor able to author rich-text content (for example a lower-privileged editor, or imported/external content) can achieve stored XSS against editors and site viewers. This issue is fixed in versions @tinacms/mdx 2.1.7 and tinacms 3.9.3.

• CWE-79
• CWE-87

• https://github.com/tinacms/tinacms/pull/7056
• https://github.com/tinacms/tinacms/security/advisories/GHSA-2vcc-5v34-9jc8

Published

Jul 1, 2026

Last Modified

Jul 6, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-55653A flaw was found in OpenSSH. A malicious SSH server can expl…6.5
• CVE-2026-55654A flaw was found in OpenSSH. This vulnerability, a heap out-…3.7
• CVE-2026-55655A flaw was found in OpenSSH. A local unprivileged attacker o…6.1
• CVE-2026-55659Grist is spreadsheet software using Python as its formula la…7.7
• CVE-2026-5566A vulnerability was detected in UTT HiPER 1250GW up to 3.2.7…8.8
• CVE-2026-55660Tina is a headless content management system. In versions pr…7.6
• CVE-2026-55664Grist is spreadsheet software using Python as its formula la…4.3
• CVE-2026-55665Grist is spreadsheet software using Python as its formula la…8.5
• CVE-2026-55666Rocket.Chat is an open-source, secure, fully customizable co…9.3
• CVE-2026-55667File Browser is a file managing interface for uploading, del…8.2
• CVE-2026-55668File Browser provides a web file managing interface. Prior t…6.3
• CVE-2026-55669ZITADEL is an open source identity management platform. Prio…4.2