Cross-Site Scripting (XSS) in @tinacms/web-components (CVE-2026-108260)
Summary
Cross-site scripting in @tinacms/web-components (CVE-2026-108260). Confidential information can be exposed externally. Exploitable via href. Mitigation: upgrade to 0.2.1 or later.
Original description
The description as published by the source.
Summary
`` renders a rich-text AST into the DOM and, for a nodes, assigns the node's URL straight to the anchor's href with no scheme check. A link authored in the CMS as javascript:… renders as a live javascript: anchor, so a visitor who clicks it executes attacker-supplied script in the site's origin. Every sibling renderer in the repository already sanitizes these URLs; this one does not.
Details
The unvalidated sink:
packages/@tinacms/web-components/src/tina-markdown.js:67-69
if (node.type === 'html' || node.type === 'html_inline') {
return DOMPurify.sanitize(node.value, { RETURN_DOM_FRAGMENT: true });
}
packages/@tinacms/web-components/src/tina-markdown.js:75 if (node.url && node.type === 'a') el.href = node.url;
packages/@tinacms/web-components/src/tina-markdown.js:76 if (node.url && node.type === 'img') el.src = node.url;
node.url comes from the content attribute the site populates from the TinaCMS content API (:169-176), i.e. whatever a content author typed into a rich-text field. The DOMPurify call at :68 handles only raw-HTML node values and returns before the anchor branch, so it never inspects node.url. Line 75 is a direct property assignment — no HTML parser, no sanitizer. The mode: 'open' shadow root (:164-167) provides no script isolation.
The guard that exists in every sibling renderer:
packages/@tinacms/mdx/src/sanitize-url.ts:10 allowedSchemes = ['http','https','mailto','tel','xref']
pac…
Source: GitHub Security Advisories (Global) NVD GitHub Advisory
Auto-generated summary
Assembled by SecPulse from the source data (CVSS, CWE, affected versions) using templates — no AI involved. Check the original description and references below for exact details.
A vulnerability tracked as CVE-2026-108260 has been found in @tinacms/web-components.
Attackers can target a specific entry point like href over the network to misuse the product.
Confidential information can be exposed externally. CVSS score: 7.6/10.
What to do: upgrade @tinacms/web-components to 0.2.1 or later.
If unsure, ask your IT team or search "@tinacms/web-components CVE-2026-108260" on the vendor's site.
CVE-2026-108260 (@tinacms/web-components) — CWE-79 / CVSS v3 7.6
Attack vector: remote (network-reachable)
Attack surface: href / node.url / content / components
Patched: 0.2.1 — apply immediately
Plan: 1) Audit SBOM/dependencies, 2) Stage→prod upgrade, 3) Add WAF/proxy monitoring on affected endpoints, 4) Hunt IOCs in logs.
Refs: see the GHSA / vendor advisory / patched release linked on this page.
Cross-site scripting (XSS) (CWE-79) exists in @tinacms/web-components. Attackers reach the vulnerable code path via href.
Check the vendor advisory for the affected versions of @tinacms/web-components. Attack surface: href / node.url / content / components.
Severity: High (CVSS 7.6/10). Confidential information can be exposed externally.
Update to 0.2.1.
Until the patch is applied: disable the affected feature, apply WAF rules, or restrict access via network ACLs.
Search webserver/proxy logs for unusual request patterns matching this CVE's known IOCs. Run grep -r '@tinacms/web-components' . against your dependency files (package-lock.json, requirements.txt, go.sum) to find affected services.
Response actions
Concrete steps and command examples for SOC/SRE teams to execute in order
-
1Identify exposure identify
grep -r '@tinacms/web-components' . | grep -v node_modulesリポジトリと本番環境の依存ファイル (package-lock.json / requirements.txt / go.sum / Gemfile.lock 等) で
@tinacms/web-componentsを grep し、稼働しているサービス・バージョンを把握する。 -
2Apply patch patch
Upgrade @tinacms/web-components to 0.2.1ステージング環境で 0.2.1 に上げて回帰テスト → 本番反映。回帰テストはアプリの主要ハッピーパスを含めること。
-
3Post-deployment verification verify
Confirm patched version is live in productionパッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番ではアクセスログ・WAF でアラート再発が無いか継続監視。