Summary
Tina CMS CLI before 3.0.0 can generate JavaScript containing an unescaped Git branch value, allowing a crafted branch name to inject executable expressions. When the generated client module is imported during a preview build, the code may execute with build-process privileges and expose credentials, deployment artifacts, or network services.
Tina CMS CLI before 3.0.0 can generate JavaScript containing an unescaped Git branch value, allowing a crafted branch name to inject executable expressions. When the generated client module is imported during a preview build, the code may execute with build-process privileges and expose credentials, deployment artifacts, or network services.
Affected context
The issue occurs in Tina's Next.js code-generation workflow when the CLI reads a branch value from VERCEL_GIT_COMMIT_REF, GITHUB_BRANCH, or HEAD and embeds that value into an API URL inside generated JavaScript string literals. Deployments are at risk when an attacker can influence the Git branch name and a preview build imports the generated client module.
The issue occurs in Tina's Next.js code-generation workflow when the CLI reads a branch value from VERCEL_GIT_COMMIT_REF, GITHUB_BRANCH, or HEAD and embeds that value into an API URL inside generated JavaScript string literals. Deployments are at risk when an attacker can influence the Git branch name and a preview build imports the generated client module.
Exploit preconditions
- Attack surface: Tina CMS CLI Next.js code-generation and preview-build
workflow
- Required access: Ability to create or control a Git branch name that reaches
the relevant environment variable or HEAD value
- Trigger point: Generated client-module import during a preview build - Why exploitation is possible: The raw branch value is interpolated into
JavaScript source without context-aware escaping, allowing a quote to alter
the generated program structure
- Attack surface: Tina CMS CLI Next.js code-generation and preview-build
workflow
- Required access: Ability to create or control a Git branch name that reaches
the relevant environment variable or HEAD value
- Trigger point: Generated client-module import during a preview build - Why exploitation is possible: The raw branch value is interpolated into
JavaScript source without context-aware escaping, allowing a quote to alter
the generated program structure
Why this happens
The underlying bug is context-sensitive output encoding failure. A value treated as ordinary Git metadata is inserted directly into JavaScript string literals while generating source code. A branch name containing a delimiter can terminate the intended literal and introduce a new expression, matching CWE-94, Improper Control of Generation of Code.
The underlying bug is context-sensitive output encoding failure. A value treated as ordinary Git metadata is inserted directly into JavaScript string literals while generating source code. A branch name containing a delimiter can terminate the intended literal and introduce a new expression, matching CWE-94, Improper Control of Generation of Code.
Potential impact
- Arbitrary JavaScript execution during the build process may occur
- Environment credentials and other build secrets could be exposed
- Deployment artifacts could be modified or poisoned
- Network requests could be issued using build-system access
- Downstream preview or deployment environments could be compromised
- Arbitrary JavaScript execution during the build process may occur
- Environment credentials and other build secrets could be exposed
- Deployment artifacts could be modified or poisoned
- Network requests could be issued using build-system access
- Downstream preview or deployment environments could be compromised
General mitigation guidance
Mitigation generally centers on preventing untrusted metadata from becoming executable source. Prefer structured data or safe serialization APIs over string-based JavaScript generation, and apply context-aware escaping whenever source generation is unavoidable. Reduce trust in branch-derived values through allowlists and canonicalization, validate generated output before execution, keep preview builds isolated, and grant build processes only the permissions they require. Secrets should be minimized and unavailable to untrusted preview builds where possible.
Mitigation generally centers on preventing untrusted metadata from becoming executable source. Prefer structured data or safe serialization APIs over string-based JavaScript generation, and apply context-aware escaping whenever source generation is unavoidable. Reduce trust in branch-derived values through allowlists and canonicalization, validate generated output before execution, keep preview builds isolated, and grant build processes only the permissions they require. Secrets should be minimized and unavailable to untrusted preview builds where possible.
How teams detect issues like this
Detection can include static-analysis rules for concatenating environment or Git metadata into JavaScript source, especially inside quoted literals. Code reviews should flag generated-code templates that interpolate branch names or other repository-controlled values without explicit encoding. CI policies can scan generated artifacts for unexpected executable constructs, restrict untrusted branch names in preview workflows, and use automated security review tools to identify code-generation injection patterns.
Detection can include static-analysis rules for concatenating environment or Git metadata into JavaScript source, especially inside quoted literals. Code reviews should flag generated-code templates that interpolate branch names or other repository-controlled values without explicit encoding. CI policies can scan generated artifacts for unexpected executable constructs, restrict untrusted branch names in preview workflows, and use automated security review tools to identify code-generation injection patterns.
