CVE-2023-25164 Sensitive Information leak via Script File in TinaCMS

What is CVE-2023-25164?

CVE-2023-25164 is a high-severity vulnerability in tinacms, published on 8 Feb 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Tinacms is a Git-backed headless content management system with support for visual editing. Sites being built with @tinacms/cli >= 1.0.0 && < 1.0.9 which store sensitive values in the process.env variable are impacted. These values will be added in plaintext to the index.js file. If you're on a version prior to 1.0.0 this vulnerability does not affect you. If you are affected and your Tina-enabled website has sensitive credentials stored as environment variables (eg. Algolia API keys) you should rotate those keys immediately. This issue has been patched in @tinacms/[email protected]. Users are advised to upgrade. There are no known workarounds for this issue.

Weakness: CWE-532, CWE-200

Which versions are affected by CVE-2023-25164?

2 open source packages ship an affected version, including @tinacms/cli. It affects 1 product.

Products include Ssw Tinacms\/Cli.

How do I fix CVE-2023-25164?

Upgrade @tinacms/cli to 1.0.9 or later.

Is CVE-2023-25164 being exploited?

There is no known exploitation of CVE-2023-25164 in the wild and no public exploit code.

Other vulnerabilities in tinacms

• CVE-2026-28792 Cross-Origin File Exfiltration via CORS Misconfiguration + Path Traversal in TinaCMS Critical 9.7
• CVE-2026-28793 Path Traversal Leading to Arbitrary File Read, Write and Delete in TinaCMS High 8.4
• CVE-2024-45391 Tina search token leak via lock file in TinaCMS High 7.5
• CVE-2026-28791 Path Traversal in Media Upload Handle in Tina High 7.4
• CVE-2026-34603 @tinacms/graphql's Media Endpoints Can Escape the Media Root via Symlinks or Junctions High 7.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-pc2q-jcxq-rjrr.