CVE-2026-126774 is a high-severity (CVSS 8.2) Code Injection vulnerability in tinacms @tinacms/mdx. A fix is available — see the affected versions and patch details below.
@tinacms/mdx before 2.4.2 contains a code injection vulnerability in its MDX serializer, which writes rich-text values into MDX expressions without escaping them. Authenticated content…
Description
@tinacms/mdx before 2.4.2 contains a code injection vulnerability in its MDX serializer, which writes rich-text values into MDX expressions without escaping them. Authenticated content editors can save crafted values that break out of list field or highlightColor expressions in the stored .mdx file, executing JavaScript in visitors' browsers or on build and server-side rendering hosts.
Affected Products
@tinacms/mdxtinacmsDetection & mitigation playbook
Vendor / applianceDetect
Inventory every tinacms @tinacms/mdx deployment and check each version against the affected-products list above.
Fix
Apply the tinacms @tinacms/mdx security patch or hotfix for CVE-2026-126774 on the affected version, following the vendor advisory for your exact build.
Workarounds
Stop passing untrusted input into the interpreter or shell: call the affected binary with an argument array rather than a composed command string, reject anything outside a strict allowlist of expected values, and run the component under an account that cannot reach beyond the work it legitimately does. Alongside that, restrict the management interface to trusted networks and apply the vendor's recommended configuration mitigations.
Frequently Asked Questions
Is CVE-2026-126774 being exploited in your environment?
Detect and block the exploit chain at execution, on systems you cannot patch yet.