CVE-2026-55661

Name of the Vulnerable Software and Affected Versions @tinacms/mdx versions prior to 2.1.7 tinacms versions prior to 3.9.3

Description Rich-text parsing and the default link/image renderers fail to sanitize the url field on Slate link/image nodes. This allows content containing javascript: or data:text/html URLs—including versions that use case-variants, whitespace padding, or control-character obfuscation—to be rendered into href or src attributes. Consequently, an actor capable of authoring rich-text content, such as a lower-privileged editor or through imported external content, can execute a stored Cross-Site Scripting (XSS) attack against editors and site viewers.

Recommendations Update @tinacms/mdx to version 2.1.7 or later. Update tinacms to version 3.9.3 or later.