CVE-2026-108260

Summary

A content management system allows authors to store links with script-capable URL schemes like 'javascript:' or 'data:', which execute attacker code when clicked by visitors. This creates a cross-site scripting vulnerability that can steal credentials from editors and administrators.

Exploitability

Exploitation is moderately easy as it requires only a content author to create a malicious link, but the attack depends on visitor interaction with the rendered page containing the vulnerable link.

Blast radius

The impact could be significant if editors or administrators visit pages with malicious links, potentially exposing their credentials and allowing further access to the CMS admin interface.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 0.2.1 or later to fix the URL validation issue in the tina-markdown component.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.