CVE-2026-108260 @tinacms/web-components: `tina-markdown` writes rich-text link URLs into `href` without scheme validation, allowing stored XSS
Attackers can inject malicious scripts via stored links in TinaCMS, leading to code execution and potential credential theft for site visitors.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-108260?
CVE-2026-108260 is a high-severity cross-site scripting vulnerability in @tinacms tinacms, published on 9 Oct 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Tina is a headless content management system. Prior to 0.2.1, the tina-markdown element in packages/@tinacms/web-components/src/tina-markdown.js assigns a rich-text node.url value directly to an anchor href without validating the URL scheme. A content author can store a link using a script-capable scheme, and a visitor who clicks the rendered link executes attacker-controlled script in the site's origin. The script can access same-origin application data and, when the visitor is an editor or administrator, may expose credentials stored by the TinaCMS admin on that origin. This issue is fixed in version 0.2.1.
Which versions are affected by CVE-2026-108260?
2 open source packages ship an affected version, including @tinacms/web-components.
| Package | Affected | Fixed in |
|---|---|---|
@tinacms/web-components npm | All versions | 0.2.1 |
@tinacms/web-components npm | All versions | 0.2.1 |
How do I fix CVE-2026-108260?
Upgrade @tinacms/web-components to 0.2.1 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-108260 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-108260 exists.
Sources
Also known as GHSA-c42q-qvc3-j6vg.