Is there a public PoC exploit available for CVE-2026-15607?

Yes, a public proof-of-concept exploit is available for CVE-2026-15607. Prioritise patching immediately. EPSS: 0.3%.

Is there a patch available for CVE-2026-15607?

Yes, a patch is available for CVE-2026-15607. Update the affected software to the latest version immediately.

TanStack DB CVE-2026-15607

Q: What is the CVSS score of CVE-2026-15607?

CVE-2026-15607 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

LOW

Improperly Controlled Modification of Object Prototype Attributes (Prototype Pollution) (CWE-1321)

2026-07-13 VulDB

Information Disclosure Prototype Pollution Db

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.3 MEDIUM

Network-reachable via query API (AV:N), no special conditions (AC:L), requires low-privilege query access per PR:L in 4.0 vector; scope unchanged (S:U) and impact limited to low integrity per 4.0 VC:N/VI:L/VA:N.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jul 13, 2026 - 23:31 vuln.today

Analysis Generated

Jul 13, 2026 - 23:31 vuln.today

Severity Changed

Jul 13, 2026 - 23:22 NVD

MEDIUM LOW

CVSS changed

Jul 13, 2026 - 23:22 NVD

5.3 (MEDIUM) 2.1 (LOW)

Severity Changed

Jul 13, 2026 - 23:22 NVD

MEDIUM LOW

CVSS changed

Jul 13, 2026 - 23:22 NVD

5.3 (MEDIUM) 2.1 (LOW)

CVE Published

Jul 13, 2026 - 23:00 cve.org

LOW 2.1

DescriptionCVE.org

A vulnerability was detected in tanstack db up to 0.6.8. Affected by this vulnerability is the function select of the file src/query/compiler/select.ts of the component Alias Path Handler. The manipulation results in improperly controlled modification of object prototype attributes. The attack may be launched remotely. The exploit is now public and may be used. The patch is identified as ac09b1177a100eafa85cba3cd09dd1f53f933ded. A patch should be applied to remediate this issue.

AnalysisAI

Prototype pollution in TanStack DB's select() query compiler allows low-privileged remote attackers to mutate Object.prototype by supplying dot-notation alias paths containing reserved JavaScript property names such as __proto__, prototype, or constructor. Versions up to 0.6.8 are confirmed affected via CPE cpe:2.3:a:tanstack:db. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Recon

Obtain low-privilege query API access

Delivery

Craft select() call with __proto__ or constructor alias

Exploit

Submit query to TanStack DB select compiler

Install

Compiler splits alias on '.' without sanitization

Traverse segments onto Object.prototype

Execute

Mutate global prototype chain

Impact

Affect downstream application logic

Recon

Obtain low-privilege query API access

Delivery

Craft select() call with __proto__ or constructor alias

Exploit

Submit query to TanStack DB select compiler

Install

Compiler splits alias on '.' without sanitization

Traverse segments onto Object.prototype

Execute

Mutate global prototype chain

Impact

Affect downstream application logic

Vulnerability AssessmentAI

Exploitation	Exploitation requires the attacker to have low-privileged access to submit TanStack DB select() queries with attacker-controlled alias path strings - confirmed by PR:L in the CVSS 4.0 vector. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 4.0 score of 2.1 with vector AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N indicates low real-world severity in isolation: the attack is network-reachable with no attack complexity or prerequisites beyond low-privilege access, but impact is narrowly scoped to low integrity on the vulnerable system. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	A low-privileged user with access to a TanStack DB query interface submits a select() query with a crafted alias key such as {'__proto__.polluted': someField}, which is split on '.' and walked unsanitized into the result accumulator, writing a property directly onto Object.prototype. A publicly available proof-of-concept exists via GitHub issue #1584 demonstrating both __proto__ and constructor.prototype variants.
Remediation	Apply the patch from GitHub commit ac09b1177a100eafa85cba3cd09dd1f53f933ded (PR #1595 at https://github.com/TanStack/db/pull/1595) by upgrading @tanstack/db to the next patch release beyond 0.6.8; the changeset tags this fix as a patch-level release, but the exact tagged version is not confirmed in the available data - verify the current release tag in the npm registry or GitHub releases. … Detailed patch versions, workarounds, and compensating controls in full report.