cve.bz

CVE-2026-29066

6.2 mediumEPSS 1.0%

Medium (6.2) in ssw tinacms\/cli. EPSS 1.0% chance of exploitation in the next 30 days. Fixed in @tinacms/cli 2.1.8.

Tina is a headless content management system. Prior to 2.1.8, the TinaCMS CLI dev server configures Vite with server.fs.strict: false, which disables Vite's built-in filesystem access restriction. This allows any unauthenticated attacker who can reach the dev server to read arbitrary files on the host system. This vulnerability is fixed in 2.1.8.

Severity

CVSS 3.1

6.2 medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS
1.0% chance of exploitation in the next 30 days; higher than 64% of CVEs (scores of 2026-10-31)
CWEs
CWE-200, CWE-552
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-m48g-4wr2-j2h6npm@tinacms/cli<2.1.82.1.8

References

Check your stackJSON