Tanstack
Monthly
OS command injection in TanStack devtools-vite 0.7.0 allows a local low-privileged attacker to execute arbitrary operating system commands by manipulating the `packageName` argument to the `installPackage` function within the Development Devtools Event Bus component. Exploitation is constrained to local access with high attack complexity, yielding limited confidentiality, integrity, and availability impact on the vulnerable system only. A public proof-of-concept was disclosed via GitHub issue #464 prior to any vendor response; no patch has been released as of this analysis.
Prototype pollution in TanStack DB's select() query compiler allows low-privileged remote attackers to mutate Object.prototype by supplying dot-notation alias paths containing reserved JavaScript property names such as __proto__, prototype, or constructor. Versions up to 0.6.8 are confirmed affected via CPE cpe:2.3:a:tanstack:db. A publicly available exploit exists (GitHub issue #1584), though the vulnerability is not in CISA KEV. The CVSS 4.0 base score of 2.1 reflects low integrity impact scoped to the vulnerable system, but the downstream consequences of Object.prototype mutation in JavaScript runtimes can exceed what raw scoring conveys depending on application logic.
TanStack Query supplies asynchronous state management, server-state utilities and data fetching for the web. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
OS command injection in TanStack devtools-vite 0.7.0 allows a local low-privileged attacker to execute arbitrary operating system commands by manipulating the `packageName` argument to the `installPackage` function within the Development Devtools Event Bus component. Exploitation is constrained to local access with high attack complexity, yielding limited confidentiality, integrity, and availability impact on the vulnerable system only. A public proof-of-concept was disclosed via GitHub issue #464 prior to any vendor response; no patch has been released as of this analysis.
Prototype pollution in TanStack DB's select() query compiler allows low-privileged remote attackers to mutate Object.prototype by supplying dot-notation alias paths containing reserved JavaScript property names such as __proto__, prototype, or constructor. Versions up to 0.6.8 are confirmed affected via CPE cpe:2.3:a:tanstack:db. A publicly available exploit exists (GitHub issue #1584), though the vulnerability is not in CISA KEV. The CVSS 4.0 base score of 2.1 reflects low integrity impact scoped to the vulnerable system, but the downstream consequences of Object.prototype mutation in JavaScript runtimes can exceed what raw scoring conveys depending on application logic.
TanStack Query supplies asynchronous state management, server-state utilities and data fetching for the web. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.