[superbot-helper]

package-lock.json resolves tinacms@3.11.0 and @tinacms/app@2.5.10, both inside this advisory's ranges. The build runs tinacms build into public/admin, CI deploys out/ to the wxyc.org/* Worker, and the admin is served at https://wxyc.org/admin/ — so this is the app's own shipped surface, not a library in the abstract. This moves both packages to their first patched versions. No package.json change: ^3.9.3 (dependencies) admits 3.14.0, and @tinacms/cli's ^2.5.10 for the app admits 2.5.14.

Advisory	GHSA-x34j-47hf-4xg7 / CVE-2026-108261
Severity	critical, CVSS 3.1 9.3
Affected	tinacms <= 3.13.0, @tinacms/app <= 2.5.13
Patched	3.14.0, 2.5.14
Fix	b57dbf4

The fix commit's preview-url.test.ts it.each table, lifted verbatim and run per case: the 3.11.0 arm is its shipped PreviewInner splat-to-url statements plus getExpectedPreviewOrigin; the 3.14.0 arm is the shipped resolvePreviewPath plus getPreviewOrigin. "Frames" is where the iframe loaded; "anchor" is the origin the admin then trusted.

splat	3.11.0 frames / anchor	3.14.0
/other.example	other.example / other.example	/, rejected
//other.example	other.example / other.example	/, rejected
\\other.example	other.example / other.example	/, rejected
/\other.example	other.example / other.example	/, rejected
\t//other.example	other.example / other.example	/, rejected
//other.example/admin	other.example / other.example	/, rejected
..//other.example	other.example / other.example	/, rejected
../..//other.example	other.example / other.example	/, rejected
a/..//other.example	other.example / other.example	/, rejected
.//other.example	other.example / other.example	/, rejected

10/10 activate on 3.11.0; 0/10 on 3.14.0. The six non-it.each cases (ordinary path, query+fragment, empty, undefined, absolute URL, no origin) stay same-origin on both arms.

Limits

App-level, measured in Node, not in a browser. The admin bundle is deployed, so an editor who opens https://wxyc.org/admin/#/~//other.example/p reaches the vulnerable path; what is measured here is the frame URL and the trust anchor, not the postMessage round-trip against a live TinaCloud token. The admin was built with dummy credentials and --skip-cloud-checks. The app's own suite was run as 8 named files on both arms (149 passed, 1 skipped); there is no typecheck script. The lock move is 166 entries because tinacms 3.14.0's tree differs; it is not a minimal diff.