TanStack devtools-vite CVE-2026-78177

Exploitation requires local access to the target system with at minimum low-privileged OS credentials. The vulnerable component - the Development Devtools Event Bus in TanStack devtools-vite - is only present and active in development environments running Vite with the devtools-vite 0.7.0 plugin installed; it is not a production runtime component. The attacker must be able to influence the packageName argument reaching the installPackage function, which may require control over project configuration files, a shared repository, or direct local interaction with the development toolchain. High attack complexity (AC:H) is noted in the CVSS 4.0 vector, meaning the attacker must navigate a specific and non-trivial trigger path through the Event Bus; this is not a straightforward one-step exploit. No scope change applies - impact is confined to the vulnerable system's user context. Exploitation is not possible against default production deployments, as the affected component does not exist outside development workflows.

Real-world risk is very low. The CVSS 4.0 score of 2.0 accurately reflects the constrained attack surface: AV:L (local-only), AC:H (high complexity), PR:L (low privileges required), with no scope change and only low C/I/A impact on the vulnerable system. No subsequent-system impact is assessed. The vulnerability is not listed in CISA KEV, indicating no confirmed active exploitation in the wild. While a public proof-of-concept exists (E:P in the CVSS 4.0 vector, referencing GitHub issue #464), POC availability is a distinct signal from active exploitation and should not be conflated with it. EPSS data was not provided in the input and therefore cannot be cited. The most significant real-world limiting factor is that TanStack devtools-vite is a development-environment tool - it is absent from production deployments, substantially reducing the pool of exploitable targets. High attack complexity further constrains opportunistic exploitation. This is not a high-priority incident-response item for most organizations, but development teams using this specific version in shared or multi-user environments should monitor for a vendor patch.

An attacker with local low-privileged access to a developer workstation where TanStack devtools-vite 0.7.0 is active during a Vite development session identifies a path to supply a malicious packageName value - for example, via a crafted project configuration or shared repository - causing the installPackage function to execute injected shell commands (e.g., legitimate-pkg; malicious-command) in the context of the developer's user account. A public proof-of-concept demonstrating this injection path was disclosed via GitHub issue #464. The high attack complexity requirement means the attacker must navigate specific conditions in the Event Bus execution flow, limiting opportunistic exploitation.