EUVD-2026-64694
GHSA-7f75-jp7p-2wcj
Severity by source
CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local-only attack path through a dev-time Event Bus, low privileges required to reach the vulnerable function, high complexity to trigger injection, no scope change, and limited impact on the local development environment only.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was found in TanStack devtools-vite 0.7.0. Affected by this issue is the function installPackage of the file packages/devtools-bundler-core/src/package-manager.ts of the component Development Devtools Event Bus. The manipulation of the argument packageName results in os command injection. Attacking locally is a requirement. A high complexity level is associated with this attack. The exploitation is known to be difficult. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
AnalysisAI
OS command injection in TanStack devtools-vite 0.7.0 allows a local low-privileged attacker to execute arbitrary operating system commands by manipulating the packageName argument to the installPackage function within the Development Devtools Event Bus component. Exploitation is constrained to local access with high attack complexity, yielding limited confidentiality, integrity, and availability impact on the vulnerable system only. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires local access to the target system with at minimum low-privileged OS credentials. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Real-world risk is very low. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with local low-privileged access to a developer workstation where TanStack devtools-vite 0.7.0 is active during a Vite development session identifies a path to supply a malicious `packageName` value - for example, via a crafted project configuration or shared repository - causing the `installPackage` function to execute injected shell commands (e.g., `legitimate-pkg; malicious-command`) in the context of the developer's user account. A public proof-of-concept demonstrating this injection path was disclosed via GitHub issue #464. … |
| Remediation | No vendor-released patch has been identified at time of analysis - the TanStack devtools project was informed via issue report (https://github.com/TanStack/devtools/issues/464) but has not responded. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today