Kulesy

Cross-origin postMessage handlers allow for stored XSS and session takeover. The software registers window message listeners—specifically the useTina overlay handler, the OAuth authentication popup handler, and the admin↔preview iframe GraphQL reducer—that process `event.data` without verifying `event.origin` or `event.source`. Additionally, it posts messages using non-specific target origins. A malicious page visited by a victim, or a window in an opener/iframe relationship with a Tina admin, can forge messages to control the editor, inject preview content, or manipulate the OAuth popup channel to hijack an authenticated editing session.

Rich-text parsing and the default link/image renderers fail to sanitize the `url` field on Slate link/image nodes. This allows content containing `javascript:` or `data:text/html` URLs—including versions that use case-variants, whitespace padding, or control-character obfuscation—to be rendered into `href` or `src` attributes. Consequently, an actor capable of authoring rich-text content, such as a lower-privileged editor or through imported external content, can execute a stored Cross-Site Scripting (XSS) attack against editors and site viewers.