CVE-2024-45391: 
JavaScript vulnerability analysis and mitigation

Tina CMS's command line interface (CLI) versions prior to 1.6.2 contain a vulnerability where search tokens may be exposed through the tina-lock.json lock file. The vulnerability was discovered and disclosed on September 3, 2024, affecting sites that use Tina CMS with search functionality enabled (Vendor Advisory).

The vulnerability is classified as CWE-312 (Cleartext Storage of Sensitive Information) and has been assigned a CVSS v3.1 base score of 7.5 (HIGH) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. The issue stems from the search configuration, including the search indexer token, being written to the tina-lock.json file in cleartext (NVD, Vendor Advisory).

The vulnerability exposes sensitive search tokens that could potentially be used by unauthorized actors to access and manipulate search functionality in affected Tina CMS installations. This exposure of sensitive credentials could lead to unauthorized access to search-related features and data (Vendor Advisory).

The vulnerability has been patched in @tinacms/cli version 1.6.2. Administrators are strongly advised to upgrade to this version and immediately rotate their search tokens. The fix involves preventing the search configuration from being written to the lock file (Vendor Advisory, GitHub Commit).