Loading vulnerability…
Trusted preview origin bypass in TinaCMS
CVE-2026-108261 affects the administration preview functionality in tinacms before 3.14.0 and @tinacms/app before 2.5.14. Unsafe construction of the preview iframe URL from a hash-router splat allows attacker-controlled input to resolve to an external origin. The getExpectedPreviewOrigin function derives the trusted postMessage origin from that same URL, causing the GraphQL message channel to trust the attacker-controlled frame. An unauthenticated attacker can persuade a signed-in editor to open a crafted link and submit GraphQL queries or mutations through the editor's authenticated client, exposing or modifying protected content. The preview route is enabled by default in built administration bundles and development mode.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An attacker can read, create, modify, or delete content within the signed-in editor's permissions and receive query results at the attacker-controlled origin. On applicable self-hosted deployments, accessible data may include PBKDF2 password hashes in the authentication collection. The malicious URL fragment is not transmitted to the server and therefore is absent from ordinary server request logs. The supplied proof of concept demonstrates cross-origin messaging and responses against a stubbed API rather than a live backend compromise.
If you can’t patch tonight, do this now.
Normalize and validate the router splat before constructing the preview URL, rejecting input that resolves to an external origin, including leading slash or backslash forms and normalization tricks. Independently constrain the expected postMessage origin to window.location.origin rather than deriving trust from attacker-controlled input. No existing configuration option disables the vulnerable preview route.
Patch, then assume compromise.
Upgrade tinacms to 3.14.0 or later and @tinacms/app to 2.5.14 or later, as applicable. The fixes constrain preview message trust to the current window's origin and validate preview paths against external navigation, including a second origin check after normalization. Earlier sender-origin hardening in tinacms 3.9.3 and @tinacms/app 2.5.6 is insufficient because it does not validate the preview URL used to establish trust.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.