Vendor

    Tanstack

    5 known vulnerabilities in products by Tanstack, 1 of them actively exploited (CISA KEV).

    Key figures

    5

    Vulnerabilities

    1

    Actively exploited (KEV)

    1

    Used by ransomware

    2

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in Tanstack
    CriticalCVE-2026-45321

    Malware in 42 @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys

    In CISA KEVRansomwarealso in 3 other products

    		9.6
    CriticalCVE-2026-102989

    TanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responses

    		9.3
    MediumCVE-2026-78177

    TanStack Devtools-vite: OS Command Injection

    		4.5
    HighCVE-2024-24558

    react-query-streamed-hydration xss

    		8.2
    MediumCVE-2026-15607

    tanstack db Alias Path select.ts select prototype pollution

    		4.3