# Tina: Code injection via unescaped Git branch name in generated client source

Unescaped Git branch name interpolated into generated client.ts in @tinacms/cli lets a PR branch inject JS that executes during consumer build.

- Payout: Research
- Severity: high
- Program: TinaCMS
- Found by: canhieu
- Disclosed: 2026-10-09
- CVE: CVE-2026-108259
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-pwhx-cvv3-qj5c
- Library page: https://bugbountylibrary.com/r/ghsa%3AGHSA-pwhx-cvv3-qj5c
- Tags: area:oss domain:oss impact:integrity impact:rce kind:research platform:ghsa sev:high tech:ci-cd tech:nodejs technique:source-review vuln:rce

**Target:** @tinacms/cli codegen template (client.ts generation)
**Root cause:** genClient() interpolates the raw Git branch (from VERCEL_GIT_COMMIT_REF/GITHUB_BRANCH) into `url: '${apiURL}'` without JSON.stringify or encodeURIComponent, so a single quote in the branch closes the string literal.
**Steps:**
1. Create a Git-valid branch named `x'+(globalThis.__TINA_PROBE='hit')+'`
2. Run Tina codegen so _createApiUrl() concatenates the branch into the API URL and genClient() emits `url: 'https://content.tinajs.io/2.4/content/<clientId>/github/x'+(globalThis.__TINA_PROBE='hit')+''`
3. Compile the generated client.ts with esbuild (loader ts) as the consumer build does
4. Evaluate the compiled module; the injected expression runs and sets globalThis.__TINA_PROBE='hit'
5. Negative control with `feature/safe-branch` shows no injection
**How found:** Code review of the codegen pipeline: traced branch value from config.ts read of VERCEL_GIT_COMMIT_REF/GITHUB_BRANCH through _createApiUrl() to the genClient() template, noticing no escaping at any stage and that a quote in a valid Git ref name would break out of the string literal.
**Exploitation:** Attacker opens a PR from a branch whose name carries the payload against an OSS project using TinaCMS with Vercel/GitHub preview deployments; the preview build runs codegen, the injected expression executes with build privileges, exposing process.env secrets (NPM_TOKEN, VERCEL_TOKEN, cloud keys) and allowing artifact tampering and network exfiltration.
**Escalation:** Build-time code execution pivots to supply-chain compromise of deployed artifacts and secret exfiltration from CI environment.
**Insight:** Generated-source templates that interpolate environment-derived values (CI branch refs, tokens, config) are a code-injection sink; check whether the value's grammar (Git ref names allow quotes) permits breaking out, and test the sibling templates too.