CVE-2026-126774 · Package
NO FIX YET · SEE WHAT TO DO
The @tinacms/mdx package writes rich-text values into MDX expressions without escaping them, so a crafted value can break out of a list field or highlightColor expression in a stored .mdx file. An attacker with content-editor access can run JavaScript in visitors' browsers or on build and server-side rendering hosts.
first public Nov 3, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Sites built with TinaCMS that accept rich-text content from editors and store it as MDX. Exposure depends on the editor role being used for untrusted content and on whether the built pages or server-side rendering run the injected expression. Sites that do not use the MDX serializer, or that only let fully trusted people edit content, have less exposure.
Not affected if no-untrusted-editors, static-content-only
Who cares mdx, next.js, self-hosted, tinacms
@tinacms/mdx in the project lockfile or with npm ls @tinacms/mdx2.4.2 are listed as affected by the sources@tinacms/mdx to 2.4.2 or later (version stated by the sources)@tinacms/mdx before 2.4.2 contains a code injection vulnerability in its MDX serializer, which writes rich-text values into MDX expressions without escaping them. Authenticated content editors can save crafted values that break out of list field or highlightColor expressions in the stored .mdx file, executing JavaScript in visitors' browsers or on build and server-side rendering hosts.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.