{"id":"ghsa-ghsa-qx66-fv34-fjm8","seq":2460,"kind":"advisory","title":"TanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responses","url":"https://github.com/advisories/GHSA-qx66-fv34-fjm8","permalink":"https://vulnpulse.app/items/ghsa-ghsa-qx66-fv34-fjm8","summary":"影響: npm:@tanstack/start-server-core >= 1.143.12, < 1.169.39 → 1.169.39, npm:@tanstack/react-start >= 1.143.12, < 1.168.60 → 1.168.60, npm:@tanstack/solid-start >= 1.143.12, < 1.168.57 → 1.168.57, npm:@tanstack/vue-start >= 1.143.12, < 1.168.56 → 1.168.56\nImpact An unauthenticated attacker can craft a URL to a server function in an affected TanStack Start app. If someone opens the link, the app can return attacker-controlled HTML from its own origin and run the attacker's JavaScript there. The script can access same-origin data available to that visitor and make requests with their authority. Cause The server-function transport can pass request payload fields into internal middleware state instead of limiting them to public input fields. A malfo…","severity":"critical","techs":["nodejs","vue"],"cves":["CVE-2026-102989"],"tags":["GHSA-qx66-fv34-fjm8","@tanstack/start-server-core","@tanstack/react-start","@tanstack/solid-start","@tanstack/vue-start"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-15T20:22:20.000Z","fetched_at":"2026-10-21T16:17:46.637Z"}