Tina: Code injection via unescaped Git branch name in generated client source (CVE-2026-108259)

@tinacms/cli versions before 3.0.0 read Git branch names from environment variables such as VERCEL_GIT_COMMIT_REF and directly interpolate them into generated TypeScript client source code without escaping or encoding. This allows a maliciously crafted Git branch name containing characters like single quotes to break out of string literals and inject arbitrary JavaScript expressions. The injected code executes during the build when the generated client module is imported. The vulnerability enables build-time arbitrary code execution with access to environment variables, build artifacts, and network, posing a high risk in environments like Vercel or GitHub Actions preview deployments. The root cause is the lack of JSON serialization or URL encoding of the branch name before insertion into source templates. A fix is available that applies proper serialization and encoding.

The vulnerability allows an attacker who can create a Git branch or pull request to execute arbitrary code during the build process of a project using @tinacms/cli with preview deployments enabled. This code executes with the privileges of the build environment, potentially exposing sensitive environment variables such as tokens and secrets, modifying build artifacts to compromise the supply chain, and exfiltrating data over the network. While no active exploitation has been reported, the risk is high due to the ability to run arbitrary code in a trusted build context.

A patch is available for @tinacms/cli to address this vulnerability. The fix involves properly escaping or encoding the Git branch name before inserting it into generated source code, specifically by using JSON.stringify for serialization and encodeURIComponent for URL components. Users should upgrade to version 3.0.0 or later where this issue is resolved. Until patched, avoid using untrusted branch names in environments that trigger TinaCMS code generation during builds.