CVE-2023-25164

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Tinacms is a Git-backed headless content management system with support for visual editing. Sites being built with @tinacms/cli >= 1.0.0 && < 1.0.9 which store sensitive values in the process.env variable are impacted. These values will be added in plaintext to the index.js file. If you're on a version prior to 1.0.0 this vulnerability does not affect you. If you are affected and your Tina-enabled website has sensitive credentials stored as environment variables (eg. Algolia API keys) you should rotate those keys immediately. This issue has been patched in @tinacms/cli@1.0.9. Users are advised to upgrade. There are no known workarounds for this issue.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200 CWE-532

Affected software

No affected versions have been published.

Timeline

Published: Feb 8, 2023
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2023

CVE-2023-251654.3Helm is a tool that streamlines installing and managing Kubernetes applications.`getHostByName` is a Helm template function introduced in He CVE-2023-251666.5formula is a math and string formula parser. In versions prior to 3.0.1 crafted user-provided strings to formula's parser might lead to poly CVE-2023-251675.7Discourse is an open source discussion platform. In affected versions a malicious user can cause a regular expression denial of service usin CVE-2023-251688.2Wings is Pterodactyl's server control plane. This vulnerability can be used to delete files and directories recursively on the host system. CVE-2023-251695.3discourse-yearly-review is a discourse plugin which publishes an automated Year in Review topic. In affected versions a user present in a ye CVE-2023-25174.3The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including CVE-2023-251708.8PrestaShop is an open source e-commerce web application that, prior to version 8.0.1, is vulnerable to cross-site request forgery (CSRF). Wh CVE-2023-251715.9Kiwi TCMS, an open source test management system, does not impose rate limits in versions prior to 12.0. This makes it easier to attempt den CVE-2023-251725.4Discourse is an open-source discussion platform. Prior to version 3.0.1 of the `stable` branch and version 3.1.0.beta2 of the `beta` and `te CVE-2023-251737.8containerd is an open source container runtime. A bug was found in containerd prior to versions 1.6.18 and 1.5.18 where supplementary groups CVE-2023-251747.8Improper access control in some Intel(R) Chipset Driver Software before version 10.1.19444.8378 may allow an authenticated user to potential CVE-2023-251755.5Improper input validation in some Intel(R) Server Board BMC firmware before version 2.90 may allow a privileged user to enable information d