CVE-2024-45391: Tina search token leak via lock file in TinaCMS

September 3, 2024

Tina search token leaked via lock file (tina-lock.json) in TinaCMS. Sites building with @tinacms/cli < 1.6.2 that use a search token are impacted.

If your Tina-enabled website has search setup, you should rotate that key immediately.

References

github.com/advisories/GHSA-4qrm-9h4r-v2fx
github.com/tinacms/tinacms
github.com/tinacms/tinacms/commit/110f1ceea4574d636a64526648f7c8bf6539b26a
github.com/tinacms/tinacms/pull/4758
github.com/tinacms/tinacms/security/advisories/GHSA-4qrm-9h4r-v2fx
nvd.nist.gov/vuln/detail/CVE-2024-45391

Code Behaviors & Features

Detect and mitigate CVE-2024-45391 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →