CVE-2026-63123: CVE-2026-63123: Cross-Site Request Forgery leading to Cross-Origin Arbitrary File Write in @tinacms/cli

#security #cve #cybersecurity

CVE-2026-63123: Cross-Site Request Forgery leading to Cross-Origin Arbitrary File Write in @tinacms/cli

Vulnerability ID: CVE-2026-63123
CVSS Score: 6.5
Published: 2026-08-19

A Cross-Site Request Forgery (CSRF) vulnerability in the local development server of @tinacms/cli allowed malicious cross-origin pages to send state-changing HTTP requests. This issue permitted attackers to write arbitrary files into a developer's project directory or manipulate search and GraphQL indices without authorization.

TL;DR

A validation failure in the local TinaCMS dev server allowed external websites to perform arbitrary file writes inside the developer's project folder via cross-origin multipart form uploads.

⚠️ Exploit Status: POC

Technical Details

CWE ID: CWE-352 (Cross-Site Request Forgery)
Attack Vector: Network (Unauthenticated, requiring User Interaction)
CVSS Base Score: 6.5
Impact: High Integrity Impact (Arbitrary File Write)
Exploit Status: Proof-of-Concept
CISA KEV Status: Not Listed

Affected Systems

@tinacms/cli local development environments running prior to version 2.5.2
@tinacms/cli: < 2.5.2 (Fixed in: 2.5.2)

Code Analysis

Commit: 211997c

Reject cross-origin state-changing requests on the dev server with server-side validation

Exploit Details

GitHub Security Advisory: Advisory text outlining the conceptual bypass mechanism and how developers are affected.

Mitigation Strategies

Update @tinacms/cli to 2.5.2 or later to enable server-side origin gating
Configure dev servers to bind only to local loopback interfaces (127.0.0.1 / [::1])
Ensure web browsers used for testing local interfaces do not navigate untrusted websites simultaneously

Remediation Steps:

Navigate to the project root directory.
Execute package upgrade: npm install @tinacms/cli@latest --save-dev or yarn upgrade @tinacms/cli@latest.
Verify the installed version is 2.5.2 or higher using npx tinacms --version.

References

Read the full report for CVE-2026-63123 on our website for more details including interactive diagrams and full exploit analysis.

DEV Community