{"id":"GHSA-pc2q-jcxq-rjrr","summary":"Sensitive Information leak via Script File in TinaCMS","details":"### Impact\n\nSensitive Information leaked via script File in TinaCMS. Sites building with @tinacms/cli \u003e= 1.0.0 && \u003c 1.0.9 that store sensitive values in process.env var are impacted. If you're on a version prior to 1.0.0 this vulnerability does not affect you.\n\nIf your Tina-enabled website has sensitive credentials stored as environment variables (eg. Algolia API keys) you should rotate those keys immediately.\n\n### Patches\n\nThis issue has been patched in @tinacms/cli@1.0.9\n\n### Workarounds\n\nUpgrading, and rotating secure & exposed keys is required for the proper fix.\n\n### References\n\nhttps://github.com/tinacms/tinacms/pull/3584","aliases":["CVE-2023-25164"],"modified":"2026-09-10T03:50:07.874624044Z","published":"2023-02-08T18:18:05Z","database_specific":{"cwe_ids":["CWE-200"],"severity":"HIGH","github_reviewed":true,"github_reviewed_at":"2023-02-08T18:18:05Z","nvd_published_at":"2023-02-08T20:15:00Z"},"references":[{"type":"WEB","url":"https://github.com/tinacms/tinacms/security/advisories/GHSA-pc2q-jcxq-rjrr"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-25164"},{"type":"WEB","url":"https://github.com/tinacms/tinacms/pull/3584"},{"type":"PACKAGE","url":"https://github.com/tinacms/tinacms"}],"affected":[{"package":{"name":"@tinacms/cli","ecosystem":"npm","purl":"pkg:npm/%40tinacms/cli"},"ranges":[{"type":"SEMVER","events":[{"introduced":"1.0.0"},{"fixed":"1.0.9"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/02/GHSA-pc2q-jcxq-rjrr/GHSA-pc2q-jcxq-rjrr.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N"}]}