CVE-2026-108259: CVE-2026-108259: Code Injection in @tinacms/cli via Unsanitized Git Branch Name Interpolation

CVE-2026-108259: Code Injection in @tinacms/cli via Unsanitized Git Branch Name Interpolation

Vulnerability ID: CVE-2026-108259
CVSS Score: 8.2
Published: 2026-10-09

@tinacms/cli prior to version 3.0.0 dynamically constructs client source files using string interpolation without properly sanitizing runtime configuration variables. An attacker with permissions to create a branch or pull request can inject arbitrary JavaScript statements via a crafted Git ref name, leading to execution during automated build processes.

TL;DR

Unsanitized Git branch names allow remote code execution in @tinacms/cli during automated CI/CD builds and Vercel preview deployments.

---

⚠️ Exploit Status: POC

Technical Details

• CWE ID: CWE-94 (Improper Control of Generation of Code)
• CVSSv3.1 Score: 8.2 (High)
• CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
• Attack Vector: Network
• Exploit Status: Proof of Concept / Technical Explanation Available
• CISA KEV Status: Not Listed
• Affected Component: @tinacms/cli (packages/@tinacms/cli)
• Fixed Version: 3.0.0

Affected Systems

• Applications using @tinacms/cli < 3.0.0
• CI/CD deployment pipelines utilizing TinaCMS automated code generation
• Vercel and Netlify preview deployment workers handling TinaCMS projects
• @tinacms/cli: < 3.0.0 (Fixed in: 3.0.0)

Code Analysis

Commit: d030d41

Fix code injection vulnerability by wrapping interpolated configuration variables in JSON.stringify() during code generation

File: packages/@tinacms/cli/src/next/codegen/index.ts
@@ -369,12 +369,16 @@ export default databaseClient;
 import { queries } from "./types.js";
 export const client = createClient({ ${
       this.noClientBuildCache === false
-        ? `cacheDir: '${normalizePath(
-            this.configManager.generatedCachePath
-          )}', `
+        ? `cacheDir: ${JSON.stringify(
+            normalizePath(this.configManager.generatedCachePath)
+          )}, `
         : ''
-    }url: ${this.localContentBuild ? `process.env.TINA_LOCAL_URL || '${apiURL}'` : `'${apiURL}'`}, token: '${token}', queries, ${
-      errorPolicy ? `errorPolicy: '${errorPolicy}'` : ''
+    }url: ${
+      this.localContentBuild
+        ? `process.env.TINA_LOCAL_URL || ${JSON.stringify(apiURL)}`
+        : JSON.stringify(apiURL)
+    }, token: ${JSON.stringify(String(token))}, queries, ${
+      errorPolicy ? `errorPolicy: ${JSON.stringify(String(errorPolicy))}` : ''
     } });
 export default client;

Exploit Details

• GitHub Security Advisory: Advisory detailing code injection vulnerability via unsanitized Git ref interpolation in @tinacms/cli code generation.

Mitigation Strategies

• Upgrade @tinacms/cli to version 3.0.0 or higher
• Sanitize Git branch environment variables in build scripts prior to code generation
• Restrict automatic build triggers on untrusted pull requests from external forks

Remediation Steps:

1. Run npm install @tinacms/cli@3.0.0 to update dependency
2. Audit lockfiles to ensure older versions are purged
3. Re-deploy applications to verify fixed code generation

References

• GitHub Security Advisory GHSA-pwhx-cvv3-qj5c
• Fix Commit d030d414d39e15de79bf36e4c728d57205e71dde
• Fix Pull Request #7526
• Release Tag @tinacms/cli@3.0.0
• Official CVE Record CVE-2026-108259

---

Read the full report for CVE-2026-108259 on our website for more details including interactive diagrams and full exploit analysis.