CVE-2026-108260 with a CVSS score of 7.6 is a stored cross-site scripting vulnerability in the tina-markdown component of @tinacms/web-components (npm), where rich-text link URLs are written directly into anchor href attributes without scheme validation. The flaw occurs when the component renders rich-text content and assigns a link node's URL to the href property, allowing a javascript: URL to become a live executable anchor. A content author or other user with the ability to create or modify rich-text content can embed such a malicious URL in a link. The attack requires a visitor to click the rendered link, after which attacker-supplied script executes in the site's origin. Because the component is used to display CMS content on non-React sites, the issue can affect deployments that rely on this web component for rendering. The business impact includes potential session compromise, credential theft, unauthorized actions, defacement, or disclosure of sensitive information, which can undermine user trust, damage brand reputation, and create operational or legal exposure.
We recommend you to update @tinacms/web-components to version 0.2.1 or later.[/subscribe_to_unlock_form]
CVE-2026-108260 with a CVSS score of 7.6 is a stored cross-site scripting vulnerability in the tina-markdown component of @tinacms/web-components (npm), where rich-text link URLs are written directly into anchor href attributes without scheme validation. The flaw occurs when the component renders rich-text content and assigns a link node's URL to the href property, allowing a javascript: URL to become a live executable anchor. A content author or other user with the ability to create or modify rich-text content can embed such a malicious URL in a link. The attack requires a visitor to click the rendered link, after which attacker-supplied script executes in the site's origin. Because the component is used to display CMS content on non-React sites, the issue can affect deployments that rely on this web component for rendering. The business impact includes potential session compromise, credential theft, unauthorized actions, defacement, or disclosure of sensitive information, which can undermine user trust, damage brand reputation, and create operational or legal exposure.
We recommend you to update @tinacms/web-components to version 0.2.1 or later.[emaillocker id="1283"]
The following reports contain further technical details:
[/emaillocker]