Sensitive Information leak via Script File in TinaCMS

published 2023-02-08 3 y ago modified 2026-09-10 1 mo ago also GHSA-pc2q-jcxq-rjrr , EUVD-2023-0758

cvss: 8.6; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.7%; EPSS 0.7% chance of exploitation in 30 days, percentile 52%
public exploits: 0; none known

Tinacms is a Git-backed headless content management system with support for visual editing. Sites being built with @tinacms/cli >= 1.0.0 && < 1.0.9 which store sensitive values in the process.env variable are impacted. These values will be added in plaintext to the index.js file. If you're on a version prior to 1.0.0 this vulnerability does not affect you. If you are affected and your Tina-enabled website has sensitive credentials stored as environment variables (eg. Algolia API keys) you should rotate those keys immediately. This issue has been patched in @tinacms/cli@1.0.9. Users are advised to upgrade. There are no known workarounds for this issue.

Patch / fix

fixed in 2 links 1

npm @tinacms/cli 1.0.9
ssw tinacms/cli 1.0.9

github.com/tinacms/tinacms#3584 pull request

CISA SSVC

Exploitation: none
Automatable: yes
Technical impact: partial
Assessed: 20 mo ago (2025-03-10)

Exploit prediction

0.68% chance of exploitation in the next 30 days, higher than 52% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	8.6	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
NVD	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
GitHub	3.1	8.6	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Affected packages

ecosystem	package	affected	fixed in
npm	@tinacms/cli	>=1.0.0, <1.0.9	1.0.9

Affected products

tinacms tinacms

Classification

Weakness

CWE-532 Insertion of Sensitive Information into Log File
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

References

github.com /tinacms/tinacms/pull/3584
web, issue-tracking, patch
github.com /tinacms/tinacms/security/advisories/GHSA-pc2q-jcxq-rjrr
web, vendor-advisory
nvd.nist.gov /vuln/detail/CVE-2023-25164
advisory
github.com /tinacms/tinacms
package

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary