CVE-2026-54074 is a high-severity code injection vulnerability in @tinacms/cli (npm), affecting versions < 2.4.3. It is fixed in 2.4.3.
Description Summary @tinacms/cli contains a Remote Code Execution vulnerability in its Forestry-to-Tina migration command. The internal helper addVariablesToCode unquotes any value matching the marker "TINAINTERNAL:::(.?):::" inside the stringified collection JSON. User-supplied label and name fields from .forestry//.yml are placed into that JSON without any sanitisation. An attacker who controls a Forestry-style project can therefore inject arbitrary JavaScript into the generated tina/templates.{ts,js} file. The injected code is written at module top level, so it executes the moment the developer runs tinacms dev or tinacms build, with the developer's privileges. Details Vulnerable code path: packages/@tinacms/cli/src/cmds/forestry-migrate/util/index.ts, transformForestryFieldsToTinaFields() writes forestryField.label (and .name) straight into TinaField objects (no sanitisation). packages/@tinacms/cli/src/cmds/forestry-migrate/util/codeTransformer.ts, lines 16-22, the regex-based unquoter: ts export const addVariablesToCode = (codeWithTinaPrefix: string) => { const code = codeWithTinaPrefix.replace( /"TINAINTERNAL:::(.?):::"/g, '$1' ); return { code }; }; codeTransformer.ts lines 80-88, the field array is JSON.stringify-ed and then handed to addVariablesToCode. Because JSON.stringify does not escape single quotes or backticks, an attacker who avoids " in the payload survives the JSON pass intact. packages/@tinacms/cli/src/cmds/init/apply.ts lines 110-116, the resulting string is written to tina/templates.{ts,js} and imported by the generated tina/config.{ts,js}, which tinacms dev evaluates. Why it executes immediately: the regex unquoting allows the attacker's payload to close the surrounding object/array and the enclosing xxxFields() function, drop a top-level IIFE, and then start a dummy function that swallows the trailing JSON. The IIFE is at module scope, so it runs the instant tina/config.ts imports ./templates. PoC End-to-end verified against tinacms and @tinacms/[email protected], built from commit ae1ab5d0f of tinacms/tinacms on Windows 11 + Node.js v24 (behaviour is identical on Node 22). Step 1, attacker prepares a malicious Forestry project .forestry/settings.yml .forestry/frontmatter/templates/rce.yml Note on payload encoding. The original disclosure draft used double quotes inside the payload (console.log("RCE")). JSON.stringify escapes those to \", which makes the generated TypeScript syntactically invalid and is rejected by Prettier before the file is written. Using single quotes or backticks for the inner string literals is required for the exploit to succeed. Step 2, victim runs the standard onboarding flow Step 3, generated tina/templates.ts (verbatim, from a clean run) Step 4, observed result The === RCE SUCCESSFUL === line is printed before the dev server fails on the (intentionally minimal) config, proving the malicious code executed during config evaluation. Impact Class: Remote Code Execution (code injection into a generated source file that is automatically executed by the dev server/build). Attack vector: Any developer who runs tinacms init on a Forestry project they did not author (e.g. a starter template, a community fork, a "convert my site to Tina" service, an evaluation of a third-party CMS migration) and then runs tinacms dev or tinacms build. Privileges obtained: Full execution under the developer's user account. Practical consequences include: Exfiltration of environment variables, .env files, SSH keys, ~/.aws/credentials, ~/.npmrc tokens, ~/.config/gh/hosts.yml. Source-code modification (planting backdoors before the developer's next commit / publish). Supply-chain abuse via the developer's npm publish and git push credentials. Persistence via shell rc files or scheduled tasks. Authentication: None required from the attacker. User interaction: Required, victim must run the migration and then the dev/build command. The migration prompt defaults to "yes". Suggested Remediation Either fix is sufficient; Option B is preferred because it is structurally impossible to bypass and does not silently drop user content. Option A, sanitise user-controlled strings (the disclosure draft's proposal) Apply to every user-controlled string that flows into a TinaField object, at minimum forestryField.label, forestryField.name, forestryField.template, forestryField.config.options[], forestryField.config.source.section, and the equivalents on nested fields/templatetypes recursive paths. Option B, change the marker to a sequence that cannot survive JSON.stringify of user data JSON.stringify escapes to the six-character sequence , so any literal control character supplied via YAML can never reconstruct the marker. The internal callers (makeFieldsWithInternalCode) keep emitting real bytes, so the legitimate flow continues to work and no user content is silently mutated. Defence-in-depth Regardless of which option ships, the migration code should also: Reject forestryField.label / .name that contain newlines or NUL bytes (Forestry never produced them). Wrap the eventual prettier.format(...) call so that if formatting fails the build aborts (today an exception is propagated, which is good, keep it that way). Credit Reported by AnGrY-Althaf* ([email protected]). End-to-end PoC executed locally against [email protected] / @tinacms/[email protected] built from commit ae1ab5d0f of https://github.com/tinacms/tinacms.
Untrusted input is evaluated as executable code within the application's runtime environment. Typical impact: arbitrary code execution within the application's privilege context.
CVE-2026-54074 has a CVSS score of 7.8 (High). The vector is requires local access, no privileges required, and user interaction required. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment.
A fixed version is available (2.4.3). Upgrading removes the vulnerable code path.
npm
@tinacms/cli (< 2.4.3)@tinacms/cli → 2.4.3 (npm)Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter instead of chasing every advisory.
Kodem's Application Detection and Response identifies whether CVE-2026-54074 is reachable in your applications. Explore runtime application protection for your team.
See if CVE-2026-54074 is reachable in your applications. Get a demo
Upgrade @tinacms/cli to 2.4.3 or later to resolve this vulnerability.
Kodem Kai can prioritize this vulnerability in your dependency tree and generate a fix recommendation.
CVE-2026-54074 is a high-severity code injection vulnerability in @tinacms/cli (npm), affecting versions < 2.4.3. It is fixed in 2.4.3. Untrusted input is evaluated as executable code within the application's runtime environment.
CVE-2026-54074 has a CVSS score of 7.8 (High). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
@tinacms/cli (npm) versions < 2.4.3 is affected.
Yes. CVE-2026-54074 is fixed in 2.4.3. Upgrade to this version or later.
Whether CVE-2026-54074 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
Upgrade @tinacms/cli to 2.4.3 or later.