The vuln arises when the tina‑markdown Web Component assigns a rich‑text link URL directly to an anchor's href attribute without validating the URL scheme. A content author can embed a link that begins with a script‑capable scheme, and a user who clicks the link will have attacker‑controlled code executed in the context of the site’s origin. The malicious script can read same‑origin data, decrypt stored credentials, and manipulate the UI for editors or administrators.

The affected product is the @tinacms/web-components library, part of the Tina CMS ecosystem. Versions before @tinacms/web-components@0.2.1 expose the flaw; the upgrade to 0.2.1 fixes the issue.

The CVSS score of 7.6 indicates a high severity. No EPSS information is available, and the vulnerability is not listed in the CISA KEV catalog. Attackers need to author a malicious link and rely on the target user clicking it; once the script runs, it can access sensitive data and compromise editor or administrator sessions. The likelihood of exploitation is moderate, especially in sites that allow user‑generated content without strict URL validation.