TinaCMS's markdown web component set link and image URLs without a scheme check; a Claude-co-authored XSS hardening sanitized raw HTML but deliberately left those URL sinks, which shipped in 0.2.0.

How AI contributed: Flawed AI-written codePublished Oct 9, 2026 in tinacms/tinacms

Provisional finding. Full causal and release verification remains incomplete.

What actually happened

The tina-markdown component copied node URLs into link and image attributes without checking the scheme. The AI-co-authored hardening sent raw HTML through DOMPurify and left the URL sinks as authored, so a javascript: link runs on click. TinaCMS's content API strips such URLs, so content must bypass it. Fixed in 0.2.1.

AI-assisted change

The human-authored renderer already copied node URLs straight into href and src. Claude's hardening added DOMPurify for raw HTML nodes but left those URL sinks as authored, so a javascript: link still runs on click.

Root cause

Content API filtering means a parser bypass is needed

The TinaCMS content API strips dangerous URL schemes at parse time, so exploitation requires an AST that bypasses it. The affected package is web-components 0.2.0, where the script runs in the site origin.

AI-assisted change: Claude

4e6718357a

packages/@tinacms/web-components/src/tina-markdown.js

Fix

Fix routes link and image URLs through sanitizeUrl

The repair calls sanitizeUrl before assigning href and src, so a URL with a disallowed scheme renders empty. The change ships in 0.2.1 and the guard regression passes.

Fix authorship not yet analyzed

5295e077f0

packages/@tinacms/web-components/src/tina-markdown.js

Case facts

CVE ID: CVE-2026-108260
GHSA ID: GHSA-C42Q-QVC3-J6VG
Published: Oct 9, 2026
Severity: Not scored
Language: TypeScript
AI tool: Claude
AI role: Flawed AI-written code
Root cause: Injection & unsafe execution
Vulnerable release: @tinacms/web-components 0.2.0
Fixed release: 0.2.1

Advisory source Suggest a correction

Cite this finding

Vibe Security Radar, "CVE-2026-108260 in tinacms/tinacms," Georgia Tech SSLab, https://vibesecradar.com/cves/CVE-2026-108260/

AI-assisted change

AI-assisted changepackages/@tinacms/web-components/src/tina-markdown.js source tinacms/tinacms@4e6718357a+17−6

@@ -1,3 +1,5 @@+import DOMPurify from 'dompurify';+ const TAGS = {   h1: 'h1',

Show 1 hidden lines

   h2: 'h2',

@@ -43,16 +45,18 @@ function renderRichText(root) { }  function renderNode(node) {+  const override = TinaMarkdown.components[node.type];+  if (override) return override(node);+   if (node.type === 'text') return renderText(node); +  if (node.type === 'html' || node.type === 'html_inline') {+    return DOMPurify.sanitize(node.value, { RETURN_DOM_FRAGMENT: true });+  }+   const tag = TAGS[node.type];   const el = document.createElement(tag); -  if (node.type === 'html' || node.type === 'html_inline') {-    const htmlContainer = document.createElement('div');-    htmlContainer.innerHTML = node.value;-    return htmlContainer;

Show 20 hidden lines

-  }   if (node.url && node.type === 'a') el.href = node.url;   if (node.url && node.type === 'img') el.src = node.url; @@ -106,7 +110,14 @@ function renderText(node) {   return el; } -class TinaMarkdown extends HTMLElement {+export class TinaMarkdown extends HTMLElement {+  /**+   * Per-node-type renderers, keyed by `node.type`, each returning a DOM node.+   * Mirrors the `components` prop on the React and Astro renderers, which is+   * how a consumer opts into rendering raw HTML unsanitised.+   */+  static components = {};+   constructor() {     super();

renderNode adds DOMPurify sanitization for html and html_inline nodes and a components override, but still copies node.url directly into href and src for a and img nodes with no scheme check.

Security fix

Fixpackages/@tinacms/web-components/src/tina-markdown.js source tinacms/tinacms@5295e077f0+3−2

@@ -1,3 +1,4 @@+import { sanitizeUrl } from '@tinacms/mdx/sanitize-url'; import DOMPurify from 'dompurify';  /**@@ -72,8 +73,8 @@ function renderNode(node) {   /** @type {HTMLElement} */   const el = document.createElement(tag); -  if (node.url && node.type === 'a') el.href = node.url;-  if (node.url && node.type === 'img') el.src = node.url;+  if (node.url && node.type === 'a') el.href = sanitizeUrl(node.url);+  if (node.url && node.type === 'img') el.src = sanitizeUrl(node.url);    if (node.type === 'mdxJsxTextElement' || node.type === 'mdxJsxFlowElement') {     const override = TinaMarkdown.components[node.name];

renderNode now passes link and image URLs through sanitizeUrl before assigning href or src, so a javascript: URL renders empty instead of executable.

Patch fingerprints

AI-assisted change ab28a25681d964804d70dfef0a538c9aed9c794e5c0856f2fc30467cd163a47e · Fix 122098a756bf7f8d0941317201bd24fe2febe77554e73c982571906d26eea6b1

All 84 →

Claude-co-authored changes let OpenAPI 3.1 arrays without items pass validation, so query, deepObject and urlencoded requests reached human-written decoders that crash, until 0.149.0.
CVE-2026-100353Oct 15, 2026getkin/kin-openapiGoClaudeFlawed AI-written codeInjection & unsafe execution
Docling's opt-in Tectonic engine compiled untrusted TikZ with file access; a Claude-co-authored change in the fix narrowed its safety check, and 2.132.0 can still read local files.
CVE-2026-105744Oct 7, 2026docling-project/doclingPythonClaudeFlawed AI-written codeInjection & unsafe execution
A Cursor-assisted change restricted the content type of uploaded files only on S3 and GCS storage, so on default local storage staff uploads were still served as HTML or script.
CVE-2026-105679Oct 7, 2026TryGhost/GhostTypeScriptCursorFlawed AI-written codeInjection & unsafe execution
Coraza silently dropped arguments beyond its limit so rules never saw them; Claude-co-authored 3.8.0 fixes still let JSON array entries exceed the byte budget until 3.8.1.
CVE-2026-41510Oct 6, 2026corazawaf/corazaGoClaudeFlawed AI-written codeInjection & unsafe execution
AI-written webhook code treated an empty configured token as authenticated, then passed a caller-supplied command to a shell, enabling unauthenticated remote code execution.
MediumCVE-2026-76760Aug 20, 2026chenhg5/cc-connectGoClaudeDirect introductionInjection & unsafe execution

TinaCMS's markdown web component set link and image URLs without a scheme check; a Claude-co-authored XSS hardening sanitized raw HTML but deliberately left those URL sinks, which shipped in 0.2.0.

How AI contributed: Flawed AI-written codePublished Oct 9, 2026 in tinacms/tinacms

Provisional finding. Full causal and release verification remains incomplete.

What actually happened

AI-assisted change

AI-assisted changepackages/@tinacms/web-components/src/tina-markdown.js source tinacms/tinacms@4e6718357a+17−6

@@ -1,3 +1,5 @@+import DOMPurify from 'dompurify';+ const TAGS = {   h1: 'h1',

Show 1 hidden lines

   h2: 'h2',

@@ -43,16 +45,18 @@ function renderRichText(root) { }  function renderNode(node) {+  const override = TinaMarkdown.components[node.type];+  if (override) return override(node);+   if (node.type === 'text') return renderText(node); +  if (node.type === 'html' || node.type === 'html_inline') {+    return DOMPurify.sanitize(node.value, { RETURN_DOM_FRAGMENT: true });+  }+   const tag = TAGS[node.type];   const el = document.createElement(tag); -  if (node.type === 'html' || node.type === 'html_inline') {-    const htmlContainer = document.createElement('div');-    htmlContainer.innerHTML = node.value;-    return htmlContainer;

Show 20 hidden lines

-  }   if (node.url && node.type === 'a') el.href = node.url;   if (node.url && node.type === 'img') el.src = node.url; @@ -106,7 +110,14 @@ function renderText(node) {   return el; } -class TinaMarkdown extends HTMLElement {+export class TinaMarkdown extends HTMLElement {+  /**+   * Per-node-type renderers, keyed by `node.type`, each returning a DOM node.+   * Mirrors the `components` prop on the React and Astro renderers, which is+   * how a consumer opts into rendering raw HTML unsanitised.+   */+  static components = {};+   constructor() {     super();

renderNode adds DOMPurify sanitization for html and html_inline nodes and a components override, but still copies node.url directly into href and src for a and img nodes with no scheme check.

Security fix

Fixpackages/@tinacms/web-components/src/tina-markdown.js source tinacms/tinacms@5295e077f0+3−2

@@ -1,3 +1,4 @@+import { sanitizeUrl } from '@tinacms/mdx/sanitize-url'; import DOMPurify from 'dompurify';  /**@@ -72,8 +73,8 @@ function renderNode(node) {   /** @type {HTMLElement} */   const el = document.createElement(tag); -  if (node.url && node.type === 'a') el.href = node.url;-  if (node.url && node.type === 'img') el.src = node.url;+  if (node.url && node.type === 'a') el.href = sanitizeUrl(node.url);+  if (node.url && node.type === 'img') el.src = sanitizeUrl(node.url);    if (node.type === 'mdxJsxTextElement' || node.type === 'mdxJsxFlowElement') {     const override = TinaMarkdown.components[node.name];

renderNode now passes link and image URLs through sanitizeUrl before assigning href or src, so a javascript: URL renders empty instead of executable.

TinaCMS's markdown web component set link and image URLs without a scheme check; a Claude-co-authored XSS hardening sanitized raw HTML but deliberately left those URL sinks, which shipped in 0.2.0.

Content API filtering means a parser bypass is needed

Fix routes link and image URLs through sanitizeUrl

AI-assisted change

Security fix

More Injection & unsafe execution findings

TinaCMS's markdown web component set link and image URLs without a scheme check; a Claude-co-authored XSS hardening sanitized raw HTML but deliberately left those URL sinks, which shipped in 0.2.0.

Content API filtering means a parser bypass is needed

Fix routes link and image URLs through sanitizeUrl

AI-assisted change

Security fix

More Injection & unsafe execution findings