Answer in brief
CVE-2023-25164 records a High severity (CVSS 8.6) vulnerability in Sensitive Information leak via Script File in TinaCMS. The current sources do not mark it as known exploited. The current feed maps @tinacms/cli (npm). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 8.6. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps @tinacms/cli (npm). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| @tinacms/clinpm | >=1.0.0 <1.0.9 | 1.0.9 |
Published upstream
Feb 8, 2023
Evidence: source:osv:source_dates:source-dates:recordSource modified
Sep 10, 2026
Evidence: source:osv:source_dates:source-dates:recordFirst seen by HOL
Sep 10, 2026
### Impact Sensitive Information leaked via script File in TinaCMS. Sites building with @tinacms/cli >= 1.0.0 && < 1.0.9 that store sensitive values in process.env var are impacted. If you're on a version prior to 1.0.0 this vulnerability does not affect you. If your Tina-enabled website has sensitive credentials stored as environment variables (eg. Algolia API keys) you should rotate those keys immediately. ### Patches This issue has been patched in @tinacms/[email protected] ### Workarounds Upgrading, and rotating secure & exposed keys is required for the proper fix. ### References https://github.com/tinacms/tinacms/pull/3584
Quoted source text, attributed separately from HOL analysis.