CVE-2026-108260: 
JavaScript vulnerability analysis and mitigation

CVE-2026-108260 is a stored Cross-Site Scripting (XSS) vulnerability in the @tinacms/web-components package, specifically in the tina-markdown custom element. The tina-markdown.js renderer assigns rich-text node.url values directly to anchor href attributes without validating the URL scheme, allowing a content author to store a javascript: link that executes attacker-controlled script in any visitor's browser session on the site's origin. Affected versions are @tinacms/web-components <= 0.2.0 and tinacms < 3.14.0; the issue is fixed in @tinacms/web-components 0.2.1. It carries a CVSS v3.1 base score of 7.6 (High) (Github Advisory). The advisory was published by the TinaCMS maintainers on September 16, 2026, and added to the GitHub Advisory Database on October 9, 2026 (Github Advisory).

The root cause is improper neutralization of script-capable URI schemes in an HTML attribute (CWE-79, CWE-83). In packages/@tinacms/web-components/src/tina-markdown.js, line 75 performs a direct property assignment — el.href = node.url — with no scheme validation. The existing DOMPurify call at line 68 only sanitizes raw html/html_inline node values and returns before reaching the anchor branch, so it never inspects node.url. Every other rich-text renderer in the TinaCMS repository (React, Astro, and MDX) passes URLs through a sanitizeUrl helper that enforces an allowlist of http, https, mailto, tel, and xref schemes; the web component was the sole exception. Exploitation requires only low privileges (content author access) and user interaction (a site visitor clicking the rendered link), and the shadow root's mode: 'open' provides no script isolation (Github Advisory, TinaCMS PR #7523).

A content author with only editing privileges can store a javascript: URL in a rich-text link field; any site visitor who clicks the rendered link executes attacker-controlled JavaScript in the site's origin. Because TinaCMS serves its admin panel from the same origin (public/admin/) and stores the editor authentication token in localStorage under the key tinacms-auth, a clicking visitor who is themselves an editor or administrator will expose that credential to the attacker. The PoC demonstrated successful exfiltration of the tinacms-auth token and the page's domain, confirming high confidentiality impact and low integrity impact with no availability impact (Github Advisory). This vulnerability specifically affects non-React deployments that use the <tina-markdown> web component, as those sites do not benefit from the sanitized React renderer (Github Advisory).

A detailed, working Proof-of-Concept (PoC) was included in the security advisory itself, demonstrating script execution and localStorage credential theft using Playwright and a local loopback server (Github Advisory). No in-the-wild exploitation has been reported, and the Feedly data shows no recorded exploitation events (exploitedAt: []). The EPSS score is 0.0, indicating a currently low probability of active exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires an attacker to have content author credentials (low privileges) and relies on a site visitor clicking a malicious link (user interaction required).

1. Gain content author access: Obtain credentials for a TinaCMS content author account on the target site, either through phishing, credential stuffing, or social engineering.
2. Author a malicious link: In the TinaCMS rich-text editor, create or edit a content page and insert a hyperlink whose URL is a javascript: payload, e.g., javascript:window.__pwned=document.domain+' | localStorage[tinacms-auth]='+localStorage.getItem('tinacms-auth');void 0.
3. Publish the content: Save and publish the content so the malicious link is stored in the CMS and rendered via the <tina-markdown> web component on the public-facing site.
4. Wait for victim interaction: The tina-markdown element renders the link with the unvalidated javascript: href directly in the DOM. When any site visitor clicks the link, the script executes in the site's origin.
5. Exfiltrate credentials: If the clicking visitor is an editor or administrator, the payload reads localStorage['tinacms-auth'] (the TinaCMS editor token) and can exfiltrate it to an attacker-controlled server, enabling account takeover of the CMS admin (Github Advisory).

• Content/CMS: Rich-text content fields in TinaCMS containing links with javascript: or other non-standard URI schemes (e.g., data:, vbscript:) in the URL field.
• Network: Unexpected outbound HTTP requests from visitor browsers to unknown external domains shortly after page load or link click events, potentially carrying encoded token or domain data in query parameters.
• Logs: Web server or CDN access logs showing requests to content pages that contain javascript: strings in stored content payloads; browser console errors related to blocked script execution if CSP is in place.
• Browser/Client: Unusual localStorage access patterns on the site's origin; the key tinacms-auth being read by scripts other than the TinaCMS admin application (Github Advisory).

Upgrade @tinacms/web-components to version 0.2.1 or later, which routes all link and image URLs through the existing sanitizeUrl helper from @tinacms/mdx/sanitize-url, rejecting any scheme not in the allowlist (http, https, mailto, tel, xref) (TinaCMS Release, TinaCMS PR #7523). For tinacms (the main package), upgrade to version 3.14.0 or later. As an interim workaround where upgrading is not immediately possible, implement a strict Content Security Policy (CSP) that blocks javascript: URI execution, and audit existing rich-text content for any stored links using non-HTTP schemes. Sites using only the React or Astro renderers (not the <tina-markdown> web component) are not affected by this specific vulnerability.

The vulnerability was discovered and reported by Thai Son Dinh from VinSOC Labs (R&D), with additional credit to iaohkut-from-NightWolf-Team, and was responsibly disclosed to the TinaCMS maintainers (Github Advisory). The TinaCMS maintainer wicksipedia acknowledged the issue as an oversight — noting that six of seven rich-text renderers in the repository already applied URL sanitization — and merged the fix promptly via PR #7523 on September 8, 2026, with the patched release following on September 14, 2026 (TinaCMS PR #7523). No significant broader media coverage or notable community controversy has been identified beyond the standard advisory publication.