GHSA-c42q-qvc3-j6vg

High

GHSA-c42q-qvc3-j6vg

(CVE-2026-108260)

Published Oct 9, 2026

CVSS

7.6

HIGH

EPSS

Exploit Prediction Scoring System — the modeled probability of in-the-wild exploitation in the next 30 days.

—

Affected packages

Summary

@tinacms/web-components: `tina-markdown` writes rich-text link URLs into `href` without scheme validation, allowing stored XSS

Developer impact

Recommended action

Affected packages

Sources