CVE-2026-28792

The TinaCMS CLI development server sets the CORS header with a wildcard value (Access-Control-Allow-Origin: *), allowing any website to send requests to the local server. Combined with the path traversal flaw (CWE-22), it is possible to escape the allowed working directory and gain access to arbitrary operating system files. The attacker prepares a malicious website that the victim visits in a browser — this website automatically sends requests to the locally running TinaCMS server and performs file operations without the user's knowledge. This type of attack is referred to as a drive-by attack.

An attacker can remotely read, write, and delete arbitrary files on a developer's computer, which may lead to theft of sensitive data (e.g., API keys, environment configurations), project takeover, or malicious code execution through file substitution.

Update TinaCMS CLI to version 2.1.8 or newer, in which the vulnerability has been fixed. Until updating, it is recommended not to visit untrusted websites while the TinaCMS development server is running and to restrict access to the local server using firewall or operating system mechanisms.

TinaCMS CLI (package @tinacms/cli) in versions before 2.1.8 — affects developer machines running the development server with 'tinacms dev' command.