CVE-2026-33949: 
JavaScript vulnerability analysis and mitigation

CVE-2026-33949 is a path traversal vulnerability in @tinacms/graphql (the GraphQL package of the TinaCMS headless content management system) that allows attackers to write and overwrite arbitrary files within the project root by manipulating the relativePath parameter in GraphQL mutations. It affects all versions of @tinacms/graphql up to and including 2.2.1, and was disclosed on March 30, 2026, with a patch released in version 2.2.2. The vulnerability carries a CVSS v3.1 base score of 8.1 (High) (GitHub Advisory, TinaCMS Advisory).

The root cause is improper path validation classified as CWE-22 (Path Traversal) and CWE-73 (External Control of File Name or Path). The getValidatedPath function in packages/@tinacms/graphql/src/resolver/index.ts uses regex-based validation that fails to recognize backslashes (\) as directory separators on non-Windows platforms (Mac/Linux). An attacker can supply a crafted relativePath value such as x\..\..\..\package.json, which passes the regex check but is subsequently resolved as a directory traversal sequence by Node.js fs modules and path normalization utilities, ultimately writing outside the intended project directory. The vulnerable functions are getValidatedPath in resolver/index.ts and assertWithinBase in packages/@tinacms/graphql/src/database/bridge/filesystem.ts (TinaCMS Advisory, GitHub Advisory).

Successful exploitation allows any attacker with network access to the GraphQL API to overwrite arbitrary files within the project root, including critical configuration files such as package.json and tsconfig.json. Attackers can also place malicious scripts in the public/ directory to enable client-side attacks, or modify build scripts and server-side logic files to achieve arbitrary code execution when those files are subsequently run by the environment. While confidentiality impact is rated None (no direct data exfiltration), integrity and availability are both rated High, as critical project files can be destroyed or replaced, potentially rendering the application inoperable or fully compromised (TinaCMS Advisory, GitHub Advisory).

No public proof-of-concept exploit code has been observed in the wild, and there is no evidence of active exploitation at this time (GitHub Advisory). The advisory itself includes a PoC curl command demonstrating the attack, which lowers the barrier for exploitation. The EPSS score is approximately 0.154–0.282% (52nd percentile), indicating a moderate relative probability of exploitation within 30 days. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no threat actor attribution has been reported (GitHub Advisory).

1. Reconnaissance: Identify internet-facing or locally accessible TinaCMS development servers running @tinacms/graphql version 2.2.1 or earlier, typically listening on port 4001.
2. Identify the GraphQL endpoint: Confirm the GraphQL API is accessible at http://<target>:4001/graphql (or the configured port) without authentication requirements.
3. Craft the malicious relativePath: Construct a path using backslashes to traverse directories, e.g., x\..\..\..\package.json, which bypasses the regex validation in getValidatedPath but resolves as a traversal on Mac/Linux.
4. Send the malicious GraphQL mutation: Issue a POST request with the crafted payload:

curl -X POST http://<target>:4001/graphql \
  -H "Content-Type: application/json" \
  -d '{"query": "mutation { updateDocument(collection: \"global\", relativePath: \"x\\\\..\\\\..\\\\..\\\\package.json\", params: { global: { header: { name: \"OVERWRITTEN\" } } }) { __typename } }"}'

5. Verify file overwrite: Confirm that the target file (e.g., package.json) has been replaced with the attacker-controlled content.
6. Escalate to code execution: Modify a build script or server-side logic file (e.g., a postinstall script in package.json) to include a malicious command, then trigger a build or install process to achieve arbitrary code execution on the server (TinaCMS Advisory, GitHub Advisory).

• Network: Unexpected HTTP POST requests to the TinaCMS GraphQL endpoint (default: port 4001) containing relativePath values with backslash sequences (e.g., x\..\..\) in the request body; requests originating from unknown or external IP addresses.
• File System: Unexpected modification timestamps on critical project files such as package.json, tsconfig.json, or files in the public/ directory; file contents replaced with unexpected or minimal JSON/text payloads; presence of unfamiliar scripts in public/ or build directories.
• Logs: Web server or application logs showing GraphQL updateDocument mutations with anomalous relativePath values containing backslash characters; repeated mutation attempts from the same source IP targeting different file paths.
• Process: Unexpected child processes spawned by the Node.js TinaCMS process following a build or install event (e.g., sh, bash, curl, wget, or reverse shell processes) (TinaCMS Advisory).

Upgrade @tinacms/graphql to version 2.2.2 or later, which patches the path traversal vulnerability (GitHub Advisory, TinaCMS Advisory). As interim mitigations, restrict network access to the TinaCMS GraphQL API endpoint (e.g., bind only to localhost or use a Web Application Firewall to block external access), and implement authentication requirements for GraphQL mutations if not already enforced. Audit the assertWithinBase and getValidatedPath functions to ensure backslash characters are normalized and treated as directory separators before path validation on all platforms.

The vulnerability was reported by security researcher aarjubh and published by wicksipedia via the GitHub Security Advisory program on March 30, 2026 (TinaCMS Advisory). Brief community discussion was noted on Mastodon and Bluesky following NVD publication, with automated CVE tracking accounts sharing the advisory details. Red Hat also tracked the vulnerability in their CVE database (GitHub Advisory). No significant vendor statements beyond the advisory or notable media coverage have been identified.