Solid Start
Monthly
Reflected cross-site scripting in TanStack Start server functions lets an unauthenticated attacker craft a server-function URL that causes the application's own origin to return attacker-controlled HTML, which executes in the browser of any visitor who opens that URL and can then read same-origin data or issue requests with the victim's authority. The flaw affects @tanstack/start-server-core from 1.143.12 through versions before 1.169.39, plus @tanstack/react-start before 1.168.60, @tanstack/solid-start before 1.168.57, and @tanstack/vue-start before 1.168.56 (TanStack Router before release-2026-09-30-1747). Exploitation is unauthenticated (PR:N) but requires victim interaction (UI:R) - the target must open the attacker-supplied URL - and no public exploit code or active exploitation has been identified at time of analysis, so the 9.3 score reflects the high confidentiality and integrity impact of the same-origin script injection rather than confirmed in-the-wild attacks.
Reflected cross-site scripting in TanStack Start server functions lets an unauthenticated attacker craft a server-function URL that causes the application's own origin to return attacker-controlled HTML, which executes in the browser of any visitor who opens that URL and can then read same-origin data or issue requests with the victim's authority. The flaw affects @tanstack/start-server-core from 1.143.12 through versions before 1.169.39, plus @tanstack/react-start before 1.168.60, @tanstack/solid-start before 1.168.57, and @tanstack/vue-start before 1.168.56 (TanStack Router before release-2026-09-30-1747). Exploitation is unauthenticated (PR:N) but requires victim interaction (UI:R) - the target must open the attacker-supplied URL - and no public exploit code or active exploitation has been identified at time of analysis, so the 9.3 score reflects the high confidentiality and integrity impact of the same-origin script injection rather than confirmed in-the-wild attacks.