PT-2025-52257

CVE-2025-68278

Published

2025-12-18

Updated

2026-10-06

Description by

CVSS 3.1

8.8

High

MetricsAV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Tina versions prior to 3.1.1

Description Tina is a headless content management system. Versions of Tina prior to 3.1.1 improperly utilize the gray-matter package, potentially allowing attackers who control the content of markdown files—such as blog posts—to execute arbitrary code.

Recommendations Update to Tina version 3.1.1 or later. Update to @tinacms/cli version 2.0.4 or later. Update to @tinacms/graphql version 2.0.3 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Cristianstaicu

Vendors

Affected products

Weakness enumeration

CWE-94: Improper Control of Generation of Code (\'Code Injection\')

Related identifiers

CVE-2025-68278