CVE-2026-55660

Name of the Vulnerable Software and Affected Versions @tinacms/app versions prior to 2.5.6 tinacms versions prior to 3.9.3

Description Cross-origin postMessage handlers allow for stored XSS and session takeover. The software registers window message listeners—specifically the useTina overlay handler, the OAuth authentication popup handler, and the admin↔preview iframe GraphQL reducer—that process event.data without verifying event.origin or event.source. Additionally, it posts messages using non-specific target origins. A malicious page visited by a victim, or a window in an opener/iframe relationship with a Tina admin, can forge messages to control the editor, inject preview content, or manipulate the OAuth popup channel to hijack an authenticated editing session.

Recommendations Update @tinacms/app to version 2.5.6. Update tinacms to version 3.9.3.