---
id: "CVE-2026-126774"
page: "https://infrastack.ai/live/CVE-2026-126774"
kind: "vulnerability"
aliases: ["CVE-2026-126774"]
title: "TinaCMS MDX serializer: content editors can inject JavaScript into pages"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["mdx", "next.js", "package", "self-hosted", "tinacms"]
not_affected_if: ["no-untrusted-editors", "static-content-only"]
published_at: "2026-11-11T19:17:37+00:00"
first_seen_at: "2026-11-11T19:28:46+00:00"
updated_at: "2026-11-11T19:29:46+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126774", "first_seen_at": "2026-11-11T19:28:46+00:00"}]
exploit_sources: []
---

# TinaCMS MDX serializer: content editors can inject JavaScript into pages

Link for people: https://infrastack.ai/live/CVE-2026-126774 (this .md is for agents)

The @tinacms/mdx package writes rich-text values into MDX expressions without escaping them, so a crafted value can break out of a list field or highlightColor expression in a stored .mdx file. An attacker with content-editor access can run JavaScript in visitors' browsers or on build and server-side rendering hosts.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of `@tinacms/mdx` in the project lockfile or with `npm ls @tinacms/mdx`
- Versions below `2.4.2` are listed as affected by the sources

## Fix

- Upgrade `@tinacms/mdx` to `2.4.2` or later (version stated by the sources)

## Timeline

- 2026-11-11T19:28:46+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126774

## Documents

- [advisory] Vendor advisory: github.com https://github.com/tinacms/tinacms/security/advisories/GHSA-6vw5-w22x-ghxv
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/tinacms-mdx-before-2.4.2-code-injection-via-mdx-serializer-rich-text-values
- [fix] Patch: github.com https://github.com/tinacms/tinacms/commit/19285c6deeee52c380e8b2fdeafedc9530dc0618
- [fix] Release notes: github.com https://github.com/tinacms/tinacms/releases/tag/%40tinacms/mdx%402.4.2

## From the sources

@tinacms/mdx before 2.4.2 contains a code injection vulnerability in its MDX serializer, which writes rich-text values into MDX expressions without escaping them. Authenticated content editors can save crafted values that break out of list field or highlightColor expressions in the stored .mdx file, executing JavaScript in visitors' browsers or on build and server-side rendering hosts.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_