CVE-2023-25164: Sensitive Information leak via Script File in TinaCMS
Summary
CVE-2023-25164: Sensitive Information leak via Script File in TinaCMS. Affects @tinacms/cli versions >= 1.0.0, < 1.0.9. Fixed in 1.0.9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TinaCMS is an open-source content management system that allows developers to build websites and applications with a user-friendly interface. It provides a CLI tool called @tinacms/cli, which is used for managing and configuring TinaCMS projects. The vulnerability affects versions of @tinacms/cli from 1.0.0 to 1.0.8. This vulnerability exposes sensitive information stored in process.env variables, potentially leading to unauthorized access and misuse of credentials.
Vulnerability Detail
The vulnerability in @tinacms/cli allows for the leakage of sensitive information through a script file. Websites using affected versions of @tinacms/cli that store sensitive values in process.env variables are at risk. This includes credentials such as API keys for services like Algolia. The vulnerability can be exploited by an attacker to gain access to these sensitive values. It is recommended to rotate any exposed keys immediately to mitigate the risk.
How To Fix
Latest published version: 4.0.3 as of 22 Oct 2026
npm install @tinacms/cli@4.0.3Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.0.9
This is the first release that contains the fix.
npm install @tinacms/cli@1.0.9Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround for this vulnerability. Upgrading to the patched version and rotating exposed keys are the recommended actions to address the issue.
Conclusion
The vulnerability in @tinacms/cli exposes sensitive information stored in process.env variables, potentially leading to unauthorized access. It is crucial to upgrade to version 1.0.9 of @tinacms/cli and rotate any exposed keys to mitigate the risk. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for @tinacms/cli →
FAQ
TinaCMS is an open-source content management system that provides a user-friendly interface for building websites and applications.
Versions of @tinacms/cli from 1.0.0 to 1.0.8 are affected by this vulnerability.
Any sensitive information stored in process.env variables can be leaked, including credentials like API keys.
To fix the vulnerability, upgrade @tinacms/cli to version 1.0.9 and rotate any exposed keys.
There is no specific workaround for this vulnerability. Upgrading and rotating exposed keys are the recommended actions.
References
Related vulnerabilities
Recent vulnerabilities recorded for @tinacms/cli.
