CVE-2025-68278CWE-94code-injection

CVE-2025-68278

High · published December 18, 2025

CVSS v3.1

8.8

EPSS

Percentile

40.4

In the wild

Unconfirmed

What it is

Tina is a headless content management system. In tinacms prior to version 3.1.1, tinacms uses the gray-matter package in an insecure way allowing attackers that can control the content of the processed markdown files, e.g., blog posts, to execute arbitrary code. tinacms version 3.1.1, @tinacms/cli version 2.0.4, and @tinacms/graphql version 2.0.3 contain a fix for the issue.

The record

Technical detail

CVSS v3.1: 8.8 · HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0: Not supplied
EPSS: 0.00479 · 40.4th percentile
Weakness: CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published: 2025-12-18T21:15Z

Affected products (3)

Product	Versions	Fixed in
ssw/tinacms	< 3.1.1	3.1.1
ssw/tinacms\/cli	< 2.0.4	2.0.4
ssw/tinacms\/graphql	< 2.0.3	2.0.3

References (2)

https://github.com/tinacms/tinacms/commit/fa7c27abef968e3f3a3e7d564f282bc566087569 · [email protected]https://github.com/tinacms/tinacms/security/advisories/GHSA-529f-9qwm-9628 · [email protected]

EPSS history

Timeline

18 DEC 15:27Z
tinacms vulnerable to arbitrary code execution
cvelistv5