CVE-2025-68278
Tina is a headless content management system. In tinacms prior to version 3.1.1, tinacms uses the gray-matter package in an insecure way allowing attackers that can control the content of the processed markdown files, e.g., blog posts, to execute arbitrary code. tinacms version 3.1.1, @tinacms/cli version 2.0.4, and @tinacms/graphql version 2.0.3 contain a fix for the issue.
- CVSS 4.0
- 7.3
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P - CVSS 3.1
- 8.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - EPSS
- 0.5% chance of exploitation in the next 30 days; higher than 41% of CVEs (scores of 2026-10-25)
- CWE
- CWE-94
- Published
- Modified
- Record from
- the NVD, synced
Affected
- ssw:tinacms
- ssw:tinacms\/cli
- ssw:tinacms\/graphql
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-529f-9qwm-9628 | npm | tinacms | <3.1.1 | 3.1.1 |
| GHSA-529f-9qwm-9628 | npm | @tinacms/cli | <2.0.4 | 2.0.4 |
| GHSA-529f-9qwm-9628 | npm | @tinacms/graphql | <2.0.3 | 2.0.3 |