@tinacms/graphql

Latest 4.0.0

NPM

82%

Total Score

healthy

Active organization-backed project, but workflow audits flag broad app permissions and possible template injection.

Are you affected? Scan for Free

Health Score Breakdown

Dependency profile

Twenty runtime dependencies create a meaningful maintenance and transitive-risk surface, but this is proportionate to a GraphQL content database package with broad functionality.

Workflow audit

All 20 workflows were analyzed with no untrusted checkouts or script-injection sinks, but high-confidence findings report blanket GitHub App permissions and possible template injection in publishing workflows; one action is also unpinned.

Vulnerabilities

Title	Versions	Severity
CVE-2026-34604 @tinacms/graphql is vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in versions 0.0.0 - 2.2.0.	0.0.0 - 2.2.0	High
CVE-2026-34603 @tinacms/graphql is vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in versions 0.0.0 - 2.2.1.	0.0.0 - 2.2.1	High
CVE-2026-33949 @tinacms/graphql is vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in versions 0.0.0 - 2.2.1.	0.0.0 - 2.2.1	High
CVE-2026-24125 @tinacms/graphql is vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in versions 0.0.0 - 2.1.1.	0.0.0 - 2.1.1	Medium
AIKIDO-2026-10283 @tinacms/graphql is vulnerable to Path Traversal in versions 1.0.0 - 2.1.2.	1.0.0 - 2.1.2	High