tinacms
Built from the advisories that name this package: its registry metadata (versions, licence, dependencies) has not been fetched by this service yet.
At a glance
- Ecosystem
- npm
- Vulnerability status
- 5 advisory(ies) without a verdict
Advisories (5)
| Advisory | Affected versions | Latest version |
|---|---|---|
| GHSA-2vcc-5v34-9jc8 TinaCMS rich-text (slatejson) rendering does not sanitize link/image URLs, allowing stored XSS via dangerous URL schemes | < 3.9.3 | Undetermined |
| GHSA-529f-9qwm-9628 tinacms is vulnerable to arbitrary code execution | < 3.1.1 | Undetermined |
| GHSA-5hxf-c7j4-279c Tina: Path Traversal in Media Upload Handle | < 2.1.7 | Undetermined |
| GHSA-g5qx-h5f3-mp2f TinaCMS: Cross-origin postMessage handlers and rich-text URL-sanitization bypass enable stored XSS and session takeover | < 3.9.3 | Undetermined |
| GHSA-x34j-47hf-4xg7 TinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragment | < 3.14.0 | Undetermined |
Sources
| Source | Licence |
|---|