Is there a public PoC exploit available for CVE-2026-15607?

Yes, a public proof-of-concept exploit is available for CVE-2026-15607. Prioritise patching immediately. EPSS: 0.3%.

Is there a patch available for CVE-2026-15607?

Yes, a patch is available for CVE-2026-15607. Update the affected software to the latest version immediately.

TanStack DB CVE-2026-15607

Q: What is the CVSS score of CVE-2026-15607?

CVE-2026-15607 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

LOW

Improperly Controlled Modification of Object Prototype Attributes (Prototype Pollution) (CWE-1321)

2026-07-13 VulDB

Information Disclosure Prototype Pollution Db Tanstack

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.3 MEDIUM

Network-reachable via query API (AV:N), no special conditions (AC:L), requires low-privilege query access per PR:L in 4.0 vector; scope unchanged (S:U) and impact limited to low integrity per 4.0 VC:N/VI:L/VA:N.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jul 13, 2026 - 23:31 vuln.today

Analysis Generated

Jul 13, 2026 - 23:31 vuln.today

Severity Changed

Jul 13, 2026 - 23:22 NVD

MEDIUM LOW

CVSS changed

Jul 13, 2026 - 23:22 NVD

5.3 (MEDIUM) 2.1 (LOW)

Severity Changed

Jul 13, 2026 - 23:22 NVD

MEDIUM LOW

CVSS changed

Jul 13, 2026 - 23:22 NVD

5.3 (MEDIUM) 2.1 (LOW)

CVE Published

Jul 13, 2026 - 23:00 cve.org

LOW 2.1

DescriptionCVE.org

A vulnerability was detected in tanstack db up to 0.6.8. Affected by this vulnerability is the function select of the file src/query/compiler/select.ts of the component Alias Path Handler. The manipulation results in improperly controlled modification of object prototype attributes. The attack may be launched remotely. The exploit is now public and may be used. The patch is identified as ac09b1177a100eafa85cba3cd09dd1f53f933ded. A patch should be applied to remediate this issue.

AnalysisAI

Prototype pollution in TanStack DB's select() query compiler allows low-privileged remote attackers to mutate Object.prototype by supplying dot-notation alias paths containing reserved JavaScript property names such as __proto__, prototype, or constructor. Versions up to 0.6.8 are confirmed affected via CPE cpe:2.3:a:tanstack:db. A publicly available exploit exists (GitHub issue #1584), though the vulnerability is not in CISA KEV. The CVSS 4.0 base score of 2.1 reflects low integrity impact scoped to the vulnerable system, but the downstream consequences of Object.prototype mutation in JavaScript runtimes can exceed what raw scoring conveys depending on application logic.

Technical ContextAI

TanStack DB is a JavaScript/TypeScript reactive database library. The vulnerable component is the select() query compiler in packages/db/src/query/compiler/select.ts, specifically the Alias Path Handler. CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes) describes the root cause: alias keys supplied to select() are split on '.' and their segments are walked into the result object without checking for reserved JavaScript prototype chain keywords. A crafted alias such as '__proto__.polluted' or 'constructor.prototype.polluted' causes the segment traversal to write directly onto Object.prototype, poisoning the global prototype chain for the entire JavaScript runtime. The fix introduced a blocklist (UNSAFE_ALIAS_SEGMENTS = {'__proto__', 'prototype', 'constructor'}) enforced by a new assertSafeAliasSegments() guard applied in processMerge, processNonMergeOp, and addFromObject, throwing UnsafeAliasPathError on violation. CPE confirms the affected scope as cpe:2.3:a:tanstack:db:*:*:*:*:*:*:*:* up to 0.6.8.

RemediationAI

Apply the patch from GitHub commit ac09b1177a100eafa85cba3cd09dd1f53f933ded (PR #1595 at https://github.com/TanStack/db/pull/1595) by upgrading @tanstack/db to the next patch release beyond 0.6.8; the changeset tags this fix as a patch-level release, but the exact tagged version is not confirmed in the available data - verify the current release tag in the npm registry or GitHub releases. If an immediate upgrade is not possible, the primary compensating control is to restrict access to the select() query API to fully trusted callers only, preventing untrusted input from reaching the alias path handler. Sanitizing alias keys at the application boundary before passing them to select() (rejecting keys containing __proto__, prototype, or constructor segments) is an additional defense-in-depth measure, though this duplicates what the patch implements internally. There are no known side effects of the upstream fix beyond queries using unsafe alias segments now throwing UnsafeAliasPathError instead of silently mutating the prototype.