Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
tinacms/tinacms
main @ 8c54ee1
29
Fixes
1
CVEs
CRITICAL
Peak severity
42.3%
Coverage
Highlights
Path Traversal: 10 prior fixes. Scrutinize any change in this area.
@tinacms/cli: most-fixed (4 issues). Treat as high-risk during review.
21 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Remote Code Execution: Insecure parsing of gray-matter configurations allowed the execution of arbitrary JavaScript and CoffeeScript engine parsing templates. This critical risk is tracked under CVE-2025-68278, which is triggered when an attacker gains control over markdown files.
Path Traversal: The lack of path canonicalization and strict prefix checks enabled directory traversal attacks targeting diverse object storage backends, allowing unauthorized access outside the designated mediaRoot.
Auth Bypass: The Teams authorization middleware was vulnerable to trivial bypasses by unconditionally calling next() rather than validating API permissions appropriately.