@tinacms/graphql (npm) — known CVEs & security advisories

Known CVE vulnerabilities and GitHub Security Advisories affecting the npm package @tinacms/graphql, with affected version ranges, CVSS severity, EPSS exploit prediction, and CISA KEV status.

CVEs (5)

• CVE-2025-68278 — CVSS 8.8 (high): Tina is a headless content management system. In tinacms prior to version 3.1.1, tinacms uses the gray-matter package in an insecure way…
• CVE-2026-33949 — CVSS 8.1 (high): Tina is a headless content management system. Prior to version 2.2.2, a path traversal vulnerability in @tinacms/graphql allows…
• CVE-2026-34603 — CVSS 7.1 (high): Tina is a headless content management system. Prior to version 2.2.2, @tinacms/cli recently added lexical path-traversal checks to the dev…
• CVE-2026-34604 — CVSS 7.1 (high): Tina is a headless content management system. Prior to version 2.2.2, @tinacms/graphql uses string-based path containment checks in…
• CVE-2026-24125 — CVSS 6.3 (medium): Tina is a headless content management system. Prior to 2.1.2, TinaCMS allows users to create, update, and delete content documents using…