Skip to content
Tanstack vulnerabilities
Newest
-
@tanstack react-start, solid-start, start-server-core +2 more +4 more
TanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responses
CVE-2026-102989
Fix available
9.3 Critical
-
tanstack devtools-vite
TanStack devtools-vite Development Devtools Event Bus package-manager.ts installPackage os command injection
CVE-2026-78177
2.0 Low
-
clickhouse db
tanstack db Alias Path select.ts select prototype pollution
CVE-2026-15607
5.3 Medium
-
tanstack, @tanstack arktype-adapter, eslint-plugin-router +211 more +213 more
Malware in 42 @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys
CVE-2026-45321
In KEVPublic exploitFix available
9.6 Critical
-
tanstack query, react-query-next-experimental +1 more
react-query-streamed-hydration xss
CVE-2024-24558
Fix available
8.2 High