@tinacms/web-components: `tina-markdown` writes rich-text link URLs into `href` without scheme validation, allowing stored XSS (CVE-2026-108260)

<tina-markdown> renders a rich-text abstract syntax tree (AST) into the DOM and assigns the URL from 'a' nodes directly to anchor href attributes without checking the URL scheme. Unlike other renderers in the TinaCMS repository that sanitize URLs to allow only safe schemes (http, https, mailto, tel, xref), this component lacks such validation. This omission permits javascript: URLs to be rendered as live links, enabling stored XSS when a user clicks the malicious link. The vulnerability is confirmed in versions before 0.2.1. The recommended fix is to reuse the existing sanitizeUrl function from '@tinacms/mdx/sanitize-url' to validate URLs before assignment. The vulnerability has a CVSS 3.1 score of 7.6 (High) with vector AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N.

An attacker with the ability to author rich-text content in the CMS can inject javascript: URLs that execute arbitrary scripts in the context of the site when clicked by visitors. This leads to stored cross-site scripting (XSS) with high confidentiality impact and limited integrity impact. The vulnerability requires user interaction (clicking the malicious link) and privileges to author content. There are no known exploits in the wild. The vulnerability affects the confidentiality and integrity of the site and its users.

A patch is available that fixes this vulnerability by adding URL scheme validation using the existing sanitizeUrl function from '@tinacms/mdx/sanitize-url'. Users should upgrade to version 0.2.1 or later of @tinacms/web-components. The vendor advisory confirms the fix is available. Until patched, avoid using untrusted content in <tina-markdown> or implement manual URL sanitization as a temporary measure.