Devtools Vite
Monthly
OS command injection in TanStack devtools-vite 0.7.0 allows a local low-privileged attacker to execute arbitrary operating system commands by manipulating the `packageName` argument to the `installPackage` function within the Development Devtools Event Bus component. Exploitation is constrained to local access with high attack complexity, yielding limited confidentiality, integrity, and availability impact on the vulnerable system only. A public proof-of-concept was disclosed via GitHub issue #464 prior to any vendor response; no patch has been released as of this analysis.
OS command injection in TanStack devtools-vite 0.7.0 allows a local low-privileged attacker to execute arbitrary operating system commands by manipulating the `packageName` argument to the `installPackage` function within the Development Devtools Event Bus component. Exploitation is constrained to local access with high attack complexity, yielding limited confidentiality, integrity, and availability impact on the vulnerable system only. A public proof-of-concept was disclosed via GitHub issue #464 prior to any vendor response; no patch has been released as of this analysis.