TinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragment (CVE-2026-108261)

The TinaCMS admin preview iframe source URL is derived from the hash-router splat parameter without enforcing same-origin restrictions. Specifically, a URL fragment with a double slash (e.g., #/~//attacker.example/p) results in a protocol-relative URL (//attacker.example/p) that loads an external attacker-controlled origin in the iframe. The admin uses this same unvalidated URL to compute the expected origin for the postMessage communication channel, causing the attacker-controlled iframe to be trusted. This enables the attacker to submit arbitrary GraphQL operations executed with the signed-in editor's token, granting full read and write access to the content API. The vulnerability arises from the router returning a splat with a leading slash, combined with the lack of iframe sandboxing and absence of Content Security Policy. An incomplete fix in earlier versions added origin checks but did not validate the URL source. The recommended fix is to normalize the splat to a same-origin path and restrict the expected origin to the window's origin. The vulnerability is confirmed in [email protected] and @tinacms/[email protected] and affects all earlier versions up to but not including 3.14.0 and 2.5.14 respectively.

An unauthenticated remote attacker can craft a URL that, when opened by a logged-in editor, causes the TinaCMS admin to load an attacker-controlled iframe that is trusted by the admin's postMessage channel. This allows the attacker to perform arbitrary GraphQL queries and mutations with the privileges of the signed-in editor, effectively granting full read and write access to the site's content API. This compromises the confidentiality and integrity of the site's content. There is no indication of availability impact. No known exploits in the wild have been reported as of the publication date.

A patch is available for this vulnerability. Users should upgrade TinaCMS to version 3.14.0 or later and @tinacms/app to version 2.5.14 or later, which include fixes that normalize the URL fragment to enforce same-origin restrictions and restrict the expected origin to the window's origin. The vulnerability arises from unvalidated URL fragments and lack of iframe sandboxing; the patch addresses these issues. Until patched, avoid opening untrusted URLs in the TinaCMS admin interface. No additional mitigations such as CSP or iframe sandboxing are mentioned as part of the official fix.