CVE-2026-54074

Name of the Vulnerable Software and Affected Versions @tinacms/cli versions prior to 2.4.3

Description @tinacms/cli contains a Remote Code Execution issue in its Forestry-to-Tina migration command. The internal helper function addVariablesToCode() unquotes any value matching the marker " TINA INTERNAL :::(.*?):::" inside the stringified collection JSON. Because user-supplied label and name fields from .forestry/**/*.yml files are placed into this JSON without sanitization, an attacker who controls a Forestry-style project can inject arbitrary JavaScript into the generated tina/templates.{ts,js} file. This injected code is written at the module top level and executes with the developer's privileges the moment the developer runs tinacms dev or tinacms build.

Recommendations Update @tinacms/cli to version 2.4.3 or later. As a temporary mitigation, avoid running the migration command or using tinacms dev and tinacms build on Forestry-style projects from untrusted sources.