High severity8.2NVD Advisory· Published Nov 11, 2026
CVE-2026-126774
CVE-2026-126774
Description
@tinacms/mdx before 2.4.2 contains a code injection vulnerability in its MDX serializer, which writes rich-text values into MDX expressions without escaping them. Authenticated content editors can save crafted values that break out of list field or highlightColor expressions in the stored .mdx file, executing JavaScript in visitors' browsers or on build and server-side rendering hosts.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2Patches
Vulnerability mechanics
References
6- github.com/tinacms/tinacms/blob/%40tinacms/mdx%400.60.3/packages/%40tinacms/mdx/src/stringify/acorn.tsnvd
- github.com/tinacms/tinacms/commit/19285c6deeee52c380e8b2fdeafedc9530dc0618nvd
- github.com/tinacms/tinacms/pull/7958nvd
- github.com/tinacms/tinacms/releases/tag/%40tinacms/mdx%402.4.2nvd
- github.com/tinacms/tinacms/security/advisories/GHSA-6vw5-w22x-ghxvnvd
- www.vulncheck.com/advisories/tinacms-mdx-before-2.4.2-code-injection-via-mdx-serializer-rich-text-valuesnvd
News mentions
0No linked articles in our index yet.