TanStack Start CVE-2026-102989

The application must be a TanStack Start deployment using server functions via a vulnerable package version: @tanstack/start-server-core 1.143.12 to <1.169.39, @tanstack/react-start <1.168.60, @tanstack/solid-start <1.168.57, or @tanstack/vue-start <1.168.56 (Router before release-2026-09-30-1747). The specific prerequisite is that server-function request handling accepts non-public/attacker-supplied payload fields that steer attacker-controlled middleware state onto the error path, where a response-shaped object is accepted as an HTTP response without validating it is a genuine Response - allowing attacker HTML to be returned from the app origin. Exploitation is LIMITED by required user interaction (UI:R): a victim must open the attacker's crafted server-function URL for the injected script to execute; no attacker authentication is required (PR:N). Upgrading to the fixed versions, which enforce a strict Response instanceof check, removes the condition entirely.

This is a genuine high-priority issue, not an inflated CVSS score. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N, 9.3) is internally consistent with the description: an unauthenticated, remote, low-complexity attack that crosses a security scope boundary (S:C) - the vulnerable server code is abused to compromise the victim's browser/same-origin context. The only mitigating metric is UI:R, since a victim must open the attacker's crafted server-function URL, which places this closer to reflected/stored-link XSS than to fully autonomous exploitation. No EPSS score, CISA KEV entry, or public POC was provided in the input, so there is no current evidence of active or at-scale exploitation; the severity is driven by the capability (same-origin script execution and acting with the visitor's authority) rather than by observed in-the-wild activity. The fix is confirmed available across all affected packages, so the practical risk is concentrated in deployments that have not yet upgraded. Note that EPSS/KEV/POC signals are absent from the input rather than confirmed-negative, so exploitation likelihood cannot be quantified from the data at hand.

An attacker crafts a malicious server-function URL for a vulnerable TanStack Start application and inserts non-public fields into the request payload so attacker-controlled middleware state reaches the error path, causing a response-shaped object containing attacker HTML to be accepted as the HTTP response. The attacker sends this same-origin link to a victim (e.g. via phishing); when the victim opens it, the injected script runs in the application's origin, reads same-origin data, and issues authenticated requests as that visitor. No public exploit identified at time of analysis, though the fixing commit and PR are public and detail the vulnerable code path.