CVE-2026-28792: Critical Cross-Origin File Exfiltration Vulnerability in @tinacms/cli
Summary
CVE-2026-28792: The TinaCMS CLI dev server combines a permissive CORS configuration (Access-Control-Allow-Origin: *) with the path traversal vulnerability (previously reported) to enable a browser-based drive-by attack. Affects @tinacms/cli versions < 2.1.8. Fixed in 2.1.8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TinaCMS is an open-source content management system that allows developers to create and manage content in a user-friendly manner. The @tinacms/cli package provides a command-line interface for running a development server, enabling developers to preview and edit content in real-time. However, a critical vulnerability has been identified in the CLI dev server, which can lead to severe security risks for developers using the default configuration.
Vulnerability Detail
The vulnerability arises from a combination of a permissive CORS configuration (Access-Control-Allow-Origin: *) and a path traversal flaw. This allows remote attackers to exploit the dev server by tricking developers into visiting a malicious website while the server is running. The attacker can enumerate the filesystem, read sensitive files, write arbitrary files, and delete files on the developer's machine. The attack does not require the dev server to be exposed to the internet, making it particularly dangerous.
How To Fix
Latest published version: 4.0.3 as of 22 Oct 2026
npm install @tinacms/cli@4.0.3Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.1.8
This is the first release that contains the fix.
npm install @tinacms/cli@2.1.8Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, developers can restrict the CORS configuration by modifying the server settings to allow only trusted origins. For example, instead of using
app.use(cors());
, specify allowed origins like this:
app.use(cors({ origin: 'http://your-trusted-origin.com' }));
This will help mitigate the risk until the package is updated.
Conclusion
The CVE-2026-28792 vulnerability in the @tinacms/cli package poses a significant risk to developers using the default configuration. It is crucial to update to the patched version 2.1.8 or later to mitigate these risks. Additionally, implementing a more restrictive CORS policy can serve as a temporary workaround until the update is applied.
See every vulnerability recorded for @tinacms/cli →
FAQ
The CVSS score of this vulnerability is 9.6, indicating a critical level of severity.
Every developer running the TinaCMS dev server with the default configuration is vulnerable while the server is active.
Attackers can enumerate the filesystem, discover sensitive files, write arbitrary files, and delete files on the developer's machine.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities using just your package-lock.json file.
References
Related vulnerabilities
Recent vulnerabilities recorded for @tinacms/cli.
