Tina search token leak via lock file in TinaCMS

CAO 7.5CVE-2024-45391 · GHSA-4qrm-9h4r-v2fx · Công bố 03/09/2024 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2024-45391 là lỗ hổng mức CAO (CVSS 7.5) ảnh hưởng tinacms/cli (ssw), @tinacms/cli.
Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.31%, cao hơn 23.4% các lỗ hổng khác.
Cách xử lý: cập nhật lên 1.6.2 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
tinacms/cli ssw	`< 1.6.2`	`1.6.2`
@tinacms/cli npm	`< 1.6.2`	`1.6.2`

Mô tả

Impact

Tina search token leaked via lock file (tina-lock.json) in TinaCMS. Sites building with @tinacms/cli < 1.6.2 that use a search token are impacted.

If your Tina-enabled website has search setup, you should rotate that key immediately.

Patches

This issue has been patched in @tinacms/[email protected]

Workarounds

Upgrading, and rotating search token is required for the proper fix.

References

https://github.com/tinacms/tinacms/pull/4758

Mô tả của NVD

Tina is an open-source content management system (CMS). Sites building with Tina CMS's command line interface (CLI) prior to version 1.6.2 that use a search token may be vulnerable to the search token being leaked via lock file (tina-lock.json). Administrators of Tina-enabled websites with search setup should rotate their key immediately. This issue has been patched in @tinacms/cli version 1.6.2. Upgrading and rotating the search token is required for the proper fix.