Tinacms/graphql vulnerabilities
3 known vulnerabilities in Tinacms/graphql from Ssw. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 8.8 High severity
tinacms: Improper Limitation of a Pathname to a Restricted Directory
Tina is a headless content management system. Prior to version 2.2.2, @tinacms/graphql uses string-based path containment checks in FilesystemBridge. That blocks plain ../ traversal, but it does not resolve symlink or junction targets. If a symlink/junction al
- 8.1 High severity
tinacms: Improper Limitation of a Pathname to a Restricted Directory
Tina is a headless content management system. Prior to version 2.2.2, a path traversal vulnerability in @tinacms/graphql allows unauthenticated users to write and overwrite arbitrary files within the project root. This is achieved by manipulating the relativeP
- 8.8 High severity
tinacms: Improper Control of Generation of Code
Tina is a headless content management system. In tinacms prior to version 3.1.1, tinacms uses the gray-matter package in an insecure way allowing attackers that can control the content of the processed markdown files, e.g., blog posts, to execute arbitrary cod