TinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragment
Tina is a headless content management system. Prior to tinacms 3.14.0 and @tinacms/app 2.5.14, the /~/* admin preview route in packages/tinacms/src/admin/index.tsx can turn an attacker-controlled hash-router splat into an off-origin iframe URL through packages/@tinacms/app/src/preview.tsx, while packages/@tinacms/app/src/lib/preview-origin.ts derives expectedOrigin from that same URL for the GraphQL message channel in packages/@tinacms/app/src/lib/graphql-reducer.ts. An unauthenticated attacker can send a crafted link to a signed-in editor, cause the admin to frame an attacker origin, and have that frame treated as the trusted preview. The attacker-controlled frame can submit GraphQL reads or mutations that the admin executes with the editor credentials, exposing or modifying protected content. This issue is fixed in tinacms 3.14.0 and @tinacms/app 2.5.14.
CVE-2026-108261
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-108261
tinacms
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
app
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"vendor": "tinacms",
"product": "tinacms",
"versions": [
{
"status": "affected",
"version": "< 3.14.0"
}
]
},
{
"vendor": "@tinacms",
"product": "app",
"versions": [
{
"status": "affected",
"version": "< 2.5.14"
}
]
}
]- Related CVEs
- CVE-2026-108261
Source reference:
/cveMetadata/cveId
Publisher severity
critical
Source reference: /containers/cna/metrics
- Event
- #17214 · Revision 1
- Added to Heist Feed
- Publisher date