CVE-2025-68278 | THREATINT

Description

Tina is a headless content management system. In tinacms prior to version 3.1.1, tinacms uses the gray-matter package in an insecure way allowing attackers that can control the content of the processed markdown files, e.g., blog posts, to execute arbitrary code. tinacms version 3.1.1, @tinacms/cli version 2.0.4, and @tinacms/graphql version 2.0.3 contain a fix for the issue.

PUBLISHED Reserved 2025-12-16 | Published 2025-12-18 | Updated 2025-12-18 | Assigner GitHub_M

HIGH: 7.3CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P

Problem types

CWE-94: Improper Control of Generation of Code ('Code Injection')

Product status

tinacms < 3.1.1

affected

@tinacms/cli < 2.0.4

affected

@tinacms/graphql < 2.0.3

affected

References

github.com/...inacms/security/advisories/GHSA-529f-9qwm-9628

github.com/...ommit/fa7c27abef968e3f3a3e7d564f282bc566087569

cve.org (CVE-2025-68278)

nvd.nist.gov (CVE-2025-68278)

Download JSON