CVE-2026-54074: Tina is a headless content management system. @tinacms/cli versions prior to 2.4.3 contain a Remote Code Execution vulnerability in the Forestry-to-Tina migration command. The inte

highCVSS 7.8CVE-2026-54074

Tina is a headless content management system. @tinacms/cli versions prior to 2.4.3 contain a Remote Code Execution vulnerability in the Forestry-to-Tina migration command. The internal helper addVariablesToCode unquotes any value matching the marker "__TINA_INTERNAL__:::(.*?):::" inside the stringified collection JSON. User-supplied label and name fields from .forestry/**/*.yml are placed into that JSON without any sanitisation. An attacker who controls a Forestry-style project can therefore inject arbitrary JavaScript into the generated tina/templates.{ts,js} file. The injected code is written at module top level, so it executes the moment the developer runs tinacms dev or tinacms build, with the developer's privileges. This issue has been fixed in version 2.4.3.

Details

Source: NVD Recent CVEs (US · database · site)
Severity: high — CVSS 7.8
Published: 2026-07-01
Last updated: 2026-07-02
Exploitation: Not in CISA KEV at last sync

Original advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-54074

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2026-540740.17% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 7% of all scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-54074	coverage & exploitation status	NVD · CVE.org

Recent advisories for Tina is a

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

unknownCVE-2026-55661: Tina is a headless content management system. In versions prior to @tinacms/mdx 2.1.7 and tina…nvd · 2026-07-01
unknownCVE-2026-55660: Tina is a headless content management system. In versions prior to @tinacms/app 2.5.6 and tina…nvd · 2026-07-01

CVE-2026-54074: Tina is a headless content management system. @tinacms/cli versions prior to 2.4.3 contain a Remote Code Execution vulnerability in the Forestry-to-Tina migration command. The inte

Details

Exploitation outlook

Referenced CVEs

Recent advisories for Tina is a

More from NVD Recent CVEs