Tina is a headless content management system

#!/usr/bin/env python3
# CVE-2026-28793 verifier for @tinacms/cli
# Usage: python3 check_cve_2026_28793.py /path/to/project
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import json
import os
import sys
from typing import List, Optional, Tuple

FIXED = (2, 1, 8)
TARGET = '@tinacms/cli'


def parse_version(v: str) -> Optional[Tuple[int, int, int]]:
    if not v:
        return None
    v = v.strip()
    if v.startswith('v'):
        v = v[1:]
    main = v.split('-')[0].split('+')[0]
    parts = main.split('.')
    if len(parts) < 3:
        return None
    try:
        return (int(parts[0]), int(parts[1]), int(parts[2]))
    except ValueError:
        return None


def is_vulnerable(v: str) -> Optional[bool]:
    pv = parse_version(v)
    if pv is None:
        return None
    return pv < FIXED


def walk_package_lock_deps(deps, hits: List[str]):
    if not isinstance(deps, dict):
        return
    for name, meta in deps.items():
        if name == TARGET and isinstance(meta, dict) and 'version' in meta:
            hits.append(str(meta['version']))
        if isinstance(meta, dict):
            walk_package_lock_deps(meta.get('dependencies', {}), hits)


def read_package_lock(path: str) -> List[str]:
    hits = []
    try:
        with open(path, 'r', encoding='utf-8') as f:
            data = json.load(f)
    except Exception:
        return hits

    packages = data.get('packages')
    if isinstance(packages, dict):
        key = 'node_modules/@tinacms/cli'
        if key in packages and isinstance(packages[key], dict) and 'version' in packages[key]:
            hits.append(str(packages[key]['version']))

    walk_package_lock_deps(data.get('dependencies', {}), hits)
    return hits


def read_installed_package_json(path: str) -> Optional[str]:
    try:
        with open(path, 'r', encoding='utf-8') as f:
            data = json.load(f)
        return data.get('version')
    except Exception:
        return None


def find_versions(root: str) -> List[Tuple[str, str]]:
    findings = []

    # Direct installed package
    pkg_json = os.path.join(root, 'node_modules', '@tinacms', 'cli', 'package.json')
    if os.path.isfile(pkg_json):
        v = read_installed_package_json(pkg_json)
        if v:
            findings.append((pkg_json, v))

    # package-lock.json in root or subdirs (reasonable depth)
    for current_root, dirs, files in os.walk(root):
        depth = os.path.relpath(current_root, root).count(os.sep)
        if depth > 4:
            dirs[:] = []
            continue
        if 'node_modules' in dirs and current_root != root:
            # avoid deep recursive scans under nested node_modules trees
            dirs.remove('node_modules')
        if 'package-lock.json' in files:
            lock_path = os.path.join(current_root, 'package-lock.json')
            for v in read_package_lock(lock_path):
                findings.append((lock_path, v))

    # Deduplicate
    seen = set()
    uniq = []
    for path, version in findings:
        key = (path, version)
        if key not in seen:
            uniq.append((path, version))
            seen.add(key)
    return uniq


def main() -> int:
    if len(sys.argv) != 2:
        print('UNKNOWN - usage: python3 check_cve_2026_28793.py /path/to/project')
        return 2

    root = sys.argv[1]
    if not os.path.isdir(root):
        print(f'UNKNOWN - path not found: {root}')
        return 2

    findings = find_versions(root)
    if not findings:
        print('UNKNOWN - @tinacms/cli not found in node_modules or package-lock.json')
        return 2

    vulnerable = []
    patched = []
    unknown = []

    for path, version in findings:
        verdict = is_vulnerable(version)
        if verdict is True:
            vulnerable.append((path, version))
        elif verdict is False:
            patched.append((path, version))
        else:
            unknown.append((path, version))

    if vulnerable:
        details = '; '.join([f'{v} @ {p}' for p, v in vulnerable])
        print(f'VULNERABLE - found @tinacms/cli below 2.1.8: {details}')
        return 1

    if patched and not unknown:
        details = '; '.join([f'{v} @ {p}' for p, v in patched])
        print(f'PATCHED - found @tinacms/cli at or above 2.1.8: {details}')
        return 0

    detail_parts = []
    if patched:
        detail_parts.append('patched=' + ', '.join([v for _, v in patched]))
    if unknown:
        detail_parts.append('unparsed=' + ', '.join([v for _, v in unknown]))
    print('UNKNOWN - mixed or unparseable results: ' + ' ; '.join(detail_parts))
    return 2


if __name__ == '__main__':
    sys.exit(main())