CVE-2026-108259: Code Injection in @tinacms/cli via Unsanitized Git Branch Name Interpolation

The package @tinacms/cli within the tinacms/tinacms monorepo provides CLI tools and code generation functionality for TinaCMS applications. During the build phase, @tinacms/cli executes automated code generation scripts that emit a TypeScript client configuration file (client.ts). This generated file initializes the TinaCMS client with specific runtime parameters, such as the Content API endpoint URL, authorization tokens, and caching directories.

The dynamic API URL construction mechanism extracts the current Git branch reference from hosting environment variables, including VERCEL_GIT_COMMIT_REF, GITHUB_BRANCH, or the local HEAD ref. In @tinacms/cli versions prior to 3.0.0, these extracted branch names and other configuration properties were directly interpolated into single- or double-quoted string literals within the generated JavaScript source code without escaping.

Because Git reference names permit characters such as single quotes (') and double quotes ("), a remote attacker capable of submitting a pull request or pushing a branch with a specially formatted name can escape the quote boundary. When the build system compiles or executes the generated client.ts module, the injected JavaScript executes with the full privileges of the underlying Node.js runner process.

The fundamental flaw resides in packages/@tinacms/cli/src/next/codegen/index.ts and packages/@tinacms/cli/src/next/codegen/codegen/plugin.ts. The template generation logic uses template string interpolation to emit TypeScript code.

Specifically, the apiURL string is constructed using the active Git ref name. When building the configuration object for createClient, the code generator wraps apiURL, token, cacheDir, and errorPolicy inside literal quote marks:

// Unpatched snippet in index.ts
export const client = createClient({ ${
  this.noClientBuildCache === false
    ? `cacheDir: '${normalizePath(this.configManager.generatedCachePath)}', `
    : ''
}url: ${this.localContentBuild ? `process.env.TINA_LOCAL_URL || '${apiURL}'` : `'${apiURL}'`}, token: '${token}', queries, ${
  errorPolicy ? `errorPolicy: '${errorPolicy}'` : ''
} });

If apiURL contains a single quote, the resulting output file contains premature quote termination. For example, a branch named feature/';require('child_process').execSync('id');// evaluates into the following emitted code:

export const client = createClient({
  url: 'https://content.tinajs.io/content/feature/';require('child_process').execSync('id');//',
  token: '',
  queries
});

This constitutes CWE-94 (Improper Control of Generation of Code). The failure to treat variable inputs as literal values allows arbitrary statement injection at module loading time.

To fix the vulnerability, the maintainers modified the code generator in commit d030d414d39e15de79bf36e4c728d57205e71dde. The fix replaces raw quote interpolation with JSON.stringify() calls across all dynamic configuration options.

Below is the patch diff applied to packages/@tinacms/cli/src/next/codegen/index.ts:

@@ -369,12 +369,16 @@ export default databaseClient;
 import { queries } from "./types.js";
 export const client = createClient({ ${
       this.noClientBuildCache === false
-        ? `cacheDir: '${normalizePath(
-            this.configManager.generatedCachePath
-          )}', `
+        ? `cacheDir: ${JSON.stringify(
+            normalizePath(this.configManager.generatedCachePath)
+          )}, `
         : ''
-    }url: ${this.localContentBuild ? `process.env.TINA_LOCAL_URL || '${apiURL}'` : `'${apiURL}'`}, token: '${token}', queries, ${
-      errorPolicy ? `errorPolicy: '${errorPolicy}'` : ''
+    }url: ${
+      this.localContentBuild
+        ? `process.env.TINA_LOCAL_URL || ${JSON.stringify(apiURL)}`
+        : JSON.stringify(apiURL)
+    }, token: ${JSON.stringify(String(token))}, queries, ${
+      errorPolicy ? `errorPolicy: ${JSON.stringify(String(errorPolicy))}` : ''
     } });
 export default client;

By leveraging JSON.stringify(), all dynamic values are converted into valid JSON string literals. Any internal quotes, backslashes, or control characters are automatically escaped (e.g., " becomes \"). This ensures that the generated output is strictly parsed as a string primitive, preventing syntax escape.

> [!NOTE] > The fix is complete for the identified code generation paths. Replacing string interpolation with explicit string serialization prevents code injection vectors across all dynamic variables in client.ts.

Exploitation relies on an automated deployment pipeline executing @tinacms/cli during branch or pull request preview builds. The attack flow follows these stages:

1. Payload Crafting: An attacker creates a branch name formatted to break out of string literals, such as test';process.env.AWS_SECRET_ACCESS_KEY// or containing network exfiltration payloads.
2. Pipeline Trigger: The attacker submits a pull request from a public fork or pushes the branch to a shared repository monitored by Vercel, Netlify, or GitHub Actions.
3. Code Generation: The build runner executes tinacms build or similar CLI commands. The CLI reads the Git ref from environment variables (VERCEL_GIT_COMMIT_REF or GITHUB_BRANCH) and emits the unsanitized string into client.ts.
4. Execution: The build process imports client.ts as part of the frontend compilation step. Node.js evaluates the top-level injected payload, executing code within the host runner.

Successful exploitation leads to full arbitrary code execution within the build runner container or Virtual Machine. The vulnerability carries a CVSS 3.1 base score of 8.2 with the vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N.

Primary impacts include:

• Credential Theft: Exfiltration of environment variables, including repository tokens, deployment API keys, and cloud infrastructure credentials (AWS, GCP, Vercel).
• Supply Chain Compromise: Injected code can alter build artifacts prior to deployment, embedding backdoors into production web applications.
• Lateral Movement: Attackers with execution access on CI runners may pivot to internal networks connected to the build system.

The primary remediation is upgrading @tinacms/cli to version 3.0.0 or higher.

Remediation Steps

1. Update project dependencies using standard package managers:

   npm install @tinacms/cli@3.0.0

2. Verify that package lockfiles (package-lock.json, yarn.lock, or pnpm-lock.yaml) reference @tinacms/cli version 3.0.0 or later.
3. Re-run CI/CD pipelines to ensure updated code generation logic is active.

Temporary Workarounds

If immediate package updates cannot be applied:

• Restrict automated preview builds from untrusted external repository forks.
• Sanitize branch name environment variables (VERCEL_GIT_COMMIT_REF, GITHUB_BRANCH) in CI workflow scripts prior to invoking @tinacms/cli commands.