Description
TinaCMS rich-text parsing and the default link/image renderers did not sanitize the url field on Slate link/image nodes. Content containing javascript: or data:text/html URLs — including case-variant, whitespace-padded, and control-character-obfuscated forms — is rendered into href/src and executes when the content is viewed.
Recommendation
Update the tinacms package to the latest compatible version. Followings are version details:
- Affected version(s): < 3.9.3
- Patched version(s): 3.9.3
References
Could your website be exposed too?
SmartScanner can check your website for TinaCMS rich-text (slatejson) rendering does not sanitize link/image URLs, allowing stored XSS via dangerous URL schemes and gives you actionable findings to investigate.
Start a free scanRelated Issues
- TinaCMS rich-text (slatejson) rendering does not sanitize link/image URLs, allowing stored XSS via dangerous URL schemes - @tinacms/mdx - CVE-2026-55661
- TinaCMS: Cross-origin postMessage handlers and rich-text URL-sanitization bypass enable stored XSS and session takeover - @tinacms/app - CVE-2026-55660
- TinaCMS: Cross-origin postMessage handlers and rich-text URL-sanitization bypass enable stored XSS and session takeover - CVE-2026-55660
- i18nextify has DOM XSS via javascript:/data: URL schemes in translated href/src attributes - CVE-2026-41692
You might also like:
See something that needs correcting? Let us knowUpdated June 18, 2026