CVE-2026-126774: @tinacms/mdx before 2.4.2 Code Injection via MDX Serializer Rich-Text Values
@tinacms/mdx before 2.4.2 contains a code injection vulnerability in its MDX serializer, which writes rich-text values into MDX expressions without escaping them. Authenticated content editors can save crafted values that break out of list field or highlightColor expressions in the stored .mdx file, executing JavaScript in visitors' browsers or on build and server-side rendering hosts.
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated content editor who can save crafted rich-text values can exploit it. The vulnerable serializer writes those values into stored .mdx files without escaping them.
Which content fields are implicated?
The issue can be triggered by values that break out of list field expressions or highlightColor expressions in the generated MDX.
Where can the injected JavaScript execute?
Injected code can execute in visitors' browsers and may also execute on build hosts or server-side rendering hosts that process the affected .mdx content.
What version resolves the vulnerability?
Upgrade @tinacms/mdx to version 2.4.2 or later. Versions before 2.4.2 are affected.