CVE-2026-54074— @tinacms/cli: Remote Code Execution via Forestry migration — unsanitised __TINA_INTERNAL__ marker in user-controlled YAML labels
Possible ATT&CK Techniques 1AI
T1190 · Exploit Public-Facing ApplicationGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-54074
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
@tinacms/cli: Remote Code Execution via Forestry migration — unsanitised __TINA_INTERNAL__ marker in user-controlled YAML labels
Source: NVD (National Vulnerability Database)
Vulnerability Description
Tina is a headless content management system. @tinacms/cli versions prior to 2.4.3 contain a Remote Code Execution vulnerability in the Forestry-to-Tina migration command. The internal helper addVariablesToCode unquotes any value matching the marker "__TINA_INTERNAL__:::(.*?):::" inside the stringified collection JSON. User-supplied label and name fields from .forestry/**/*.yml are placed into that JSON without any sanitisation. An attacker who controls a Forestry-style project can therefore inject arbitrary JavaScript into the generated tina/templates.{ts,js} file. The injected code is written at module top level, so it executes the moment the developer runs tinacms dev or tinacms build, with the developer's privileges. This issue has been fixed in version 2.4.3.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Source: NVD (National Vulnerability Database)
Vulnerability Type
对生成代码的控制不恰当(代码注入)
Source: NVD (National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-54074
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-54074
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-54074 (1)
Same Patch Batch · tinacms · 2026-07-01 · 3 CVEs total
| CVE-2026-55660 | TinaCMS: Cross-origin postMessage handlers and rich-text URL-sanitization bypass enable st | |
| CVE-2026-55661 | TinaCMS rich-text (slatejson) rendering does not sanitize link/image URLs, allowing stored |
IV. Related Vulnerabilities
Same product: tinacms
- CVE-2026-55660
TinaCMS: Cross-origin postMessage handlers and rich-text URL - CVE-2026-55661
TinaCMS rich-text (slatejson) rendering does not sanitize li - CVE-2026-34603
@tinacms/graphql's Media Endpoints Can Escape the Media Root - CVE-2026-34604
@tinacms/graphql's `FilesystemBridge` Path Validation Can Be - CVE-2026-33949
@tinacms/graphql has Path Traversal that leads to overwrite
Same vendor: tinacms
- CVE-2026-55660
TinaCMS: Cross-origin postMessage handlers and rich-text URL - CVE-2026-55661
TinaCMS rich-text (slatejson) rendering does not sanitize li - CVE-2026-34603
@tinacms/graphql's Media Endpoints Can Escape the Media Root - CVE-2026-34604
@tinacms/graphql's `FilesystemBridge` Path Validation Can Be - CVE-2026-33949
@tinacms/graphql has Path Traversal that leads to overwrite
Same weakness: CWE-94
- CVE-2026-11778
CURCY <= 2.2.14 - Unauthenticated Arbitrary Shortcode Execut - CVE-2026-57624
WordPress Blocksy Companion Pro plugin <= 2.1.46 - Remote Co - CVE-2026-27436
WordPress Five Star Business Profile and Schema plugin <= 2. - CVE-2026-58454
JAIOTlink C492A-W6 4.8.30.57701411 RCE via /Anyka/config End - CVE-2026-8857
Full RCE using EasyTimeline Extension
V. Comments for CVE-2026-54074
No comments yet