Code Injection Vulnerability in @tinacms/mdx by TinaCMS
CVE-2026-126774

8.8HIGH

Key Information:

Vendor

Tinacms

Status
@tinacms/mdx
Vendor
CVE Published:
11 November 2026

What is CVE-2026-126774?

@tinacms/mdx versions prior to 2.4.2 have a code injection flaw in its MDX serializer that allows authenticated content editors to insert harmful rich-text values into MDX expressions. This vulnerability enables crafted inputs to break out of list field or highlightColor expressions, potentially executing malicious JavaScript in users' browsers or on the build and server-side rendering systems. Prompt remediation is advised to protect against potential exploitation.

Affected Version(s)

@tinacms/mdx 0 < 2.4.2

@tinacms/mdx 2.4.2

References

https://github.com/tinacms/tinacms/security/advisories/GH...
vendor-advisory
https://github.com/tinacms/tinacms/pull/7958
patchissue-tracking
https://github.com/tinacms/tinacms/commit/19285c6deeee52c...
patch

CVSS V4

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Zachariah Mithani (AploSec)
.