QwikSec

Security Database

CVE

CWE

Training

CVE Database
/

CVE-2025-68278

Back to search

CVE-2025-68278

Published: Dec 18, 2025

Modified: Dec 18, 2025

PUBLISHED

Description

Tina is a headless content management system. In tinacms prior to version 3.1.1, tinacms uses the gray-matter package in an insecure way allowing attackers that can control the content of the processed markdown files, e.g., blog posts, to execute arbitrary code. tinacms version 3.1.1, @tinacms/cli version 2.0.4, and @tinacms/graphql version 2.0.3 contain a fix for the issue.

VendorProductVersions

tinacms

tinacms

affected
tinacms < 3.1.1
affected
@tinacms/cli < 2.0.4
affected
@tinacms/graphql < 2.0.3

Weaknesses (CWE)

CWE-94

References

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now
CVE-2025-68278 - Security Vulnerability | QwikSec