CVE-2026-108260: stored XSS in @tinacms/web-components (tina-markdown)

What happened

The tina-markdown component in @tinacms/web-components assigned a rich-text node.url value directly into an anchor's href attribute without validating the URL scheme. A content author could store a link that uses a script-capable scheme; when a visitor clicks that rendered link, attacker-controlled script runs in the site's origin. [4024,32643,32358]

Technical cause

Improper neutralization of input during web page generation (CWE-79). The code wrote node.url into href without validating or restricting the URL scheme, enabling non-HTTP(s) schemes to execute script in the site's origin. [4024,32643,32358]

Why it matters

Script executed in the site's origin can access same-origin application data. The advisory states that when the visitor is an editor or administrator, the injected script may expose credentials stored by the TinaCMS admin on that origin. This increases the potential impact beyond a typical content-only XSS. [4024,32643,32358]

Who is affected

@tinacms/web-components installations that use the tina-markdown element and render author-supplied rich-text links are affected. The advisory reports the package is affected from initial releases through 0.2.0, with a fix in 0.2.1. [4024,32643,32358]

Discovery and timeline

The advisory entries for this issue were published on 2026-10-09. The OSV and GitHub Advisory entries and the NVD record contain the same vulnerability summary and publication timestamps. No information about an external exploit or an individual discoverer is provided in the sources. [4024,32643,32358]

Affected versions

The advisory lists affected releases from initial releases up through 0.2.0 (<= 0.2.0). The issue is fixed in 0.2.1. [4024,32643,32358]

Fixes and mitigation

A vendor fix is available: the advisory lists 0.2.1 as the fixed release. The published advisories identify the fix version but do not include additional mitigation steps. [4024,32643,32358]

Recommended action

Upgrade @tinacms/web-components to 0.2.1 to apply the vendor fix. Review any authored content that contains links rendered by tina-markdown. The advisories do not provide other vendor-recommended mitigations in the sources. [4024,32643,32358]