Kulesy

**Name of the Vulnerable Software and Affected Versions** @tinacms/app versions prior to 2.5.6 tinacms versions prior to 3.9.3 **Description** Cross-origin postMessage handlers allow for stored XSS and session takeover. The software registers window message listeners—specifically the useTina overlay handler, the OAuth authentication popup handler, and the admin↔preview iframe GraphQL reducer—that process `event.data` without verifying `event.origin` or `event.source`. Additionally, it posts messages using non-specific target origins. A malicious page visited by a victim, or a window in an opener/iframe relationship with a Tina admin, can forge messages to control the editor, inject preview content, or manipulate the OAuth popup channel to hijack an authenticated editing session. **Recommendations** Update @tinacms/app to version 2.5.6. Update tinacms to version 3.9.3.

**Name of the Vulnerable Software and Affected Versions** @tinacms/mdx versions prior to 2.1.7 tinacms versions prior to 3.9.3 **Description** Rich-text parsing and the default link/image renderers fail to sanitize the `url` field on Slate link/image nodes. This allows content containing `javascript:` or `data:text/html` URLs—including versions that use case-variants, whitespace padding, or control-character obfuscation—to be rendered into `href` or `src` attributes. Consequently, an actor capable of authoring rich-text content, such as a lower-privileged editor or through imported external content, can execute a stored Cross-Site Scripting (XSS) attack against editors and site viewers. **Recommendations** Update @tinacms/mdx to version 2.1.7 or later. Update tinacms to version 3.9.3 or later.