CVE-2026-108259

Summary

A headless CMS system is vulnerable to code injection through Git branch names that contain quotes, allowing attackers to inject malicious JavaScript into generated API URLs during preview builds. This can lead to privilege escalation and access to sensitive deployment artifacts or environment credentials.

Exploitability

Exploitation requires a Git branch name with a quote character that terminates the string literal in the generated code, which is moderately difficult to achieve as it depends on the specific branch naming convention used by developers.

Blast radius

If exploited, attackers could gain access to deployment artifacts, environment credentials, and potentially make unauthorized network requests during preview builds, affecting the integrity of the content management system's deployment pipeline.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 3.0.0 or later to fix the code injection vulnerability in @tinacms/cli.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.