High, CVSS 7.6npmAmendedPublished
@tinacms/web-components: tina-markdown writes rich-text link URLs into href without scheme validation, allowing stored XSS
CVE-2026-108260 · GHSA-c42q-qvc3-j6vg
- Affected
- npm @tinacms/web-components <= 0.2.0
- Fixed in
- 0.2.1· Vendor fix available
- Issue
- <tina-markdown renders a rich-text AST into the DOM and, for a nodes, assigns the node's URL straight to the anchor's href with no scheme check. A link authored in the CMS as javascript:… renders as a live javascript: anchor, so a visitor who clicks it executes attacker-supplied script in the site's origin. Every sibling renderer in the repository already sanitizes these URLs; this one does not. Details The unvalidated sink: node.url comes from the content attribute the site populates from the TinaCMS content API (:169-176), i.e. whatever a content author typed into a rich-text field. The DOMPurify call at :68 handles only raw-HTML node values and returns before the anchor branch, so it never inspects node.url. Line 75 is a direct property assignment — no HTML parser, no sanitizer. The mode: 'open' shadow root (:164-167) provides no script isolation. The guard that exists in every sibling renderer: tina-markdown.js:75 is the only rich-text link sink in the repository that…
Recommended action: Upgrade to 0.2.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.