The vulnerability in the TinaCMS CLI dev server allows an attacker to combine a permissive CORS policy (Access‑Control‑Allow‑Origin: *) with a pre‑existing path traversal flaw to enumerate the local filesystem, write arbitrary files, and delete files on a developer’s machine. Key weaknesses include unvalidated file paths (CWE‑22) and insecure resource handling (CWE‑942). The result is that a malicious user could upload and execute code or modify critical configuration files, resulting in full compromise of the developer’s environment.

The flaw affects the TinaCMS CLI component from the vendor ssw, version numbers prior to 2.1.8. Any instance of the dev server running before that patch is vulnerable, regardless of the Node.js runtime version.

The CVSS score of 9.7 indicates critical severity, but the EPSS score of less than 1% suggests low exploitation probability at this time, and the vulnerability is not listed in the CISA KEV catalog. However, the attack requires only that a compromised or malicious web page be loaded while the dev server is running, which is a realistic scenario for developers leaving the dev server exposed. The combined permissive CORS and path traversal enable a direct browser‑based drive‑by attack, making the vulnerability highly exploitable where conditions are met.