CVE-2026-108259

Name of the Vulnerable Software and Affected Versions @tinacms/cli versions prior to 3.0.0

Description @tinacms/cli fails to properly escape or encode Git branch values read from VERCEL GIT COMMIT REF, GITHUB BRANCH, or HEAD. These raw values are incorporated into the API URL and interpolated into JavaScript string literals within packages/@tinacms/cli/src/next/codegen/index.ts and packages/@tinacms/cli/src/next/codegen/codegen/plugin.ts. A crafted Git-valid branch name containing a quote can terminate the generated string and inject an arbitrary JavaScript expression. This expression executes with the privileges of the build process when the generated client module is imported during a preview build, potentially allowing an attacker to read environment credentials, modify deployment artifacts, or make network requests.

Recommendations Update @tinacms/cli to version 3.0.0.