CVE-2026-63123: Arbitrary File Write Vulnerability in @tinacms/cli Dev Server
Summary
CVE-2026-63123: A browser-based cross-origin request flaw in the Tina dev server allows an attacker-controlled website to cause arbitrary file creation inside the configured media upload directory on a developer machine running tinacms... Affects @tinacms/cli versions < 2.5.2. Fixed in 2.5.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @tinacms/cli package is a command-line interface for Tina, a headless CMS that allows developers to build and manage content in their applications. It provides a local development server for testing and media uploads. However, a flaw in its CORS configuration exposes the dev server to cross-origin requests that can lead to arbitrary file creation, posing a risk to developers running the server.
Vulnerability Detail
A cross-origin request vulnerability exists in the Tina dev server, allowing an attacker-controlled website to send a multipart request that creates arbitrary files in the media upload directory. The CORS middleware does not properly reject disallowed origins, enabling the server to process the request despite the browser blocking access to the response. This flaw can lead to unauthorized file creation within the configured media root, potentially compromising the integrity of local project files.
How To Fix
Latest published version: 4.0.3 as of 22 Oct 2026
npm install @tinacms/cli@4.0.3Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.5.2
This is the first release that contains the fix.
npm install @tinacms/cli@2.5.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, developers can restrict access to the Tina dev server by using a firewall or VPN to limit which origins can access the server. Additionally, avoid running the dev server on publicly accessible networks.
Conclusion
The CVE-2026-63123 vulnerability in the @tinacms/cli package poses a significant risk to developers by allowing arbitrary file writes through cross-origin requests. It is crucial to update to the patched version to mitigate this risk and ensure the integrity of local project files.
See every vulnerability recorded for @tinacms/cli →
FAQ
CVE-2026-63123 is a vulnerability in the @tinacms/cli package that allows arbitrary file creation through cross-origin requests.
Developers running the Tina dev server on their local machines are at risk if they visit attacker-controlled websites.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for this vulnerability is 6.5, indicating a moderate severity level.
If you cannot update the package, consider implementing network restrictions or using a firewall to limit access to the Tina dev server.
References
Related vulnerabilities
Recent vulnerabilities recorded for @tinacms/cli.
