Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| tinacms | npm | < 3.9.3 | 3.9.3 |
| @tinacms/mdx | npm | < 2.1.7 | 2.1.7 |
Miggo AIRoot Cause AnalysisThe vulnerability lies in the lack of URL sanitization for rich-text content within TinaCMS. The analysis of the provided patch in pull request #7056 reveals that the issue was addressed in a comprehensive manner across multiple layers of the application.
The root cause was that user-provided rich-text content, specifically in the slatejson format, could contain malicious URLs (e.g., javascript:alert(1)) for links and images. These URLs were not sanitized at several key stages:
parseMDX function, when processing slatejson, did not inspect or clean the URLs within the JSON structure. This allowed malicious data to be saved.remarkToSlate function, which converts from Markdown AST, also failed to sanitize image URLs during the transformation process.TinaMarkdown and StaticTinaMarkdown components, which are responsible for displaying the rich text to users, would render the href and src attributes for links and images directly from the stored (and potentially malicious) data. This is the point where the XSS payload would execute in a victim's browser.The patch introduces a sanitizeUrl helper function and applies it at all of these stages. It sanitizes URLs during parsing (parseMDX), during transformation (remarkToSlate), and as a final defense-in-depth measure, during rendering (TinaMarkdown and StaticTinaMarkdown). This multi-layered approach ensures that even if unsanitized data were to somehow be stored, it would be neutralized before being rendered as active content in the browser.
parseMDXpackages/@tinacms/mdx/src/parse/index.ts
remarkToSlatepackages/@tinacms/mdx/src/parse/remarkToPlate.ts
TinaMarkdownpackages/tinacms/src/rich-text/index.tsx
StaticTinaMarkdownpackages/tinacms/src/rich-text/static.tsx