cveboard RSS feed

CVE-2026-102989

GitHubCritical, npm

TanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responses

An unauthenticated attacker can craft a URL to a server function in an affected TanStack Start app. If someone opens the link, the app can return attacker-controlled HTML from its own origin and run the attacker's JavaScript there. The script can access same-origin data available to that visitor and make requests with their authority.

No known exploitation
Severity
Critical, CVSS 9.3 (v3.1)
EPSS
0.52% chance of exploitation in 30 days (EPSS, as of Oct 23, 2026)
Affected packages