{"id":"CVE-2026-45321","published":"2026-05-12T01:16:46Z","modified":"2026-10-26T18:10:00Z","title":"TanStack Unspecified Vulnerability","vendor":"TanStack","product":"TanStack","tier":"core","eol":null,"description":{"text":"On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for TanStack/router, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes — a pull_request_target \"Pwn Request\" misconfiguration, GitHub Actions cache poisoning across the fork↔base trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process — to publish credential-stealing malware under a trusted identity. Each affected package received exactly two malicious versions, published a few minutes apart.","provenance":"source","from":"NVD"},"summary":{"text":"A malicious-code compromise affects the TanStack product's npm packages, specifically 84 versions across 42 @tanstack/* packages published under a trusted GitHub Actions OIDC identity for TanStack/router after its publish workflow was abused through a chain of pull_request_target misconfiguration, cache poisoning, and runtime extraction of the OIDC token. An attacker with network access can get credential-stealing malware into these packages by exploiting that chain, and the attack requires user interaction, such as a developer or system installing or updating one of the affected packages.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:53:14Z"},"cvss":{"score":9.6,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.03278,"percentile":0.88412,"date":"2026-10-30","provenance":"source"},"kev":{"dateAdded":"2026-05-27","dueDate":"2026-06-10","ransomware":true,"requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"This vulnerability could affect an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://github.com/TanStack/router/security/advisories/GHSA-g7cv-rxg3-hmpx ; https://nvd.nist.gov/vuln/detail/CVE-2026-45321","provenance":"source"},"vulncheckKev":{"dateAdded":"2026-05-27","exploitedFirstSeen":"2026-05-27","ransomware":true,"evidence":[{"url":"https://nefariousplan.com/posts/tanstack-cve-2026-45321-bundle-size-poisoned-release-restored","date":"2026-05-27"},{"url":"https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/5eca6dd4-073c-4bd1-b174-250eb902c1bf","date":"2026-05-27"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2026-05-27"},{"url":"https://www.ic3.gov/CSA/2026/260702.pdf","date":"2026-07-02"},{"url":"https://go.onapsis.com/one-pager/days-to-zero-sap-threat-report-2026","date":"2026-10-29"}],"evidenceTotal":5,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 31, 2026","url":"https://otx.alienvault.com/pulse/6ae4aefab0c2191cecd41862","created":"2026-10-30"},{"name":"Actively_Exploited_Kev | Oct 30, 2026","url":"https://otx.alienvault.com/pulse/6ae35d889ea92b4ce19c2680","created":"2026-10-29"},{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"}],"provenance":"machine"},"cwes":[{"id":"CWE-506","name":"Embedded Malicious Code"}],"references":[{"url":"https://github.com/TanStack/router/issues/7383","tags":["Issue Tracking"]},{"url":"https://github.com/TanStack/router/security/advisories/GHSA-g7cv-rxg3-hmpx","tags":["Mitigation","Vendor Advisory"]},{"url":"https://tanstack.com/blog/npm-supply-chain-compromise-postmortem","tags":["Exploit","Vendor Advisory"]},{"url":"https://www.stepsecurity.io/blog/mini-shai-hulud-is-back-a-self-spreading-supply-chain-attack-hits-the-npm-ecosystem","tags":["Exploit","Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-45321","tags":["US Government Resource"]}],"techniques":[{"id":"T1195.002","name":"Compromise Software Supply Chain","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: compromised build pipeline and supply chain abuse","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"a pull_request_target \"Pwn Request\" misconfiguration, GitHub Actions cache poisoning","start":373,"end":457}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1528","name":"Steal Application Access Token","tactics":["credential-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: steals OIDC token from runner memory","mappingType":"primary_impact","evidence":[{"from":"description","quote":"runtime memory extraction of the OIDC token from the Actions runner process","start":499,"end":574}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[{"id":"SRC-5629a83b43d088761158","title":"260702","publisher":"ic3.gov","url":"https://www.ic3.gov/CSA/2026/260702.pdf","date":null,"mentions":[{"quote":"CVE-2026-45321 CVE-2025-55182","start":5384,"end":5413}]}],"affected":[{"ecosystem":"npm","package":"@tanstack/arktype-adapter","vulnerableRanges":[">=1.166.12, <1.166.16",">=1.166.15, <1.166.16"],"patched":["1.166.16"],"from":["GHSA-g7cv-rxg3-hmpx"],"provenance":"source"},{"ecosystem":"npm","package":"@tanstack/eslint-plugin-router","vulnerableRanges":[">=1.161.9, <1.161.13",">=1.161.12, <1.161.13"],"patched":["1.161.13"],"from":["GHSA-g7cv-rxg3-hmpx"],"provenance":"source"},{"ecosystem":"npm","package":"@tanstack/eslint-plugin-start","vulnerableRanges":[">=0.0.4, <0.0.8",">=0.0.7, <0.0.8"],"patched":["0.0.8"],"from":["GHSA-g7cv-rxg3-hmpx"],"provenance":"source"},{"ecosystem":"npm","package":"@tanstack/history","vulnerableRanges":[">=1.161.9, <1.161.13",">=1.161.12, <1.161.13"],"patched":["1.161.13"],"from":["GHSA-g7cv-rxg3-hmpx"],"provenance":"source"},{"ecosystem":"npm","package":"@tanstack/nitro-v2-vite-plugin","vulnerableRanges":[">=1.154.12, <1.154.16",">=1.154.15, <1.154.16"],"patched":["1.154.16"],"from":["GHSA-g7cv-rxg3-hmpx"],"provenance":"source"},{"ecosystem":"npm","package":"@tanstack/react-router","vulnerableRanges":[">=1.169.5, <1.169.9",">=1.169.8, <1.169.9"],"patched":["1.169.9"],"from":["GHSA-g7cv-rxg3-hmpx"],"provenance":"source"},{"ecosystem":"npm","package":"@tanstack/react-router-devtools","vulnerableRanges":[">=1.166.16, <1.166.20",">=1.166.19, <1.166.20"],"patched":["1.166.20"],"from":["GHSA-g7cv-rxg3-hmpx"],"provenance":"source"},{"ecosystem":"npm","package":"@tanstack/react-router-ssr-query","vulnerableRanges":[">=1.166.15, <1.166.19",">=1.166.18, <1.166.19"],"patched":["1.166.19"],"from":["GHSA-g7cv-rxg3-hmpx"],"provenance":"source"},{"ecosystem":"npm","package":"@tanstack/react-start","vulnerableRanges":[">=1.167.68, <1.167.72",">=1.167.71, <1.167.72"],"patched":["1.167.72"],"from":["GHSA-g7cv-rxg3-hmpx"],"provenance":"source"},{"ecosystem":"npm","package":"@tanstack/react-start-client","vulnerableRanges":[">=1.166.51, <1.166.55",">=1.166.54, <1.166.55"],"patched":["1.166.55"],"from":["GHSA-g7cv-rxg3-hmpx"],"provenance":"source"},{"ecosystem":"npm","package":"@tanstack/react-start-rsc","vulnerableRanges":[">=0.0.47, <0.0.51",">=0.0.50, <0.0.51"],"patched":["0.0.51"],"from":["GHSA-g7cv-rxg3-hmpx"],"provenance":"source"},{"ecosystem":"npm","package":"@tanstack/react-start-server","vulnerableRanges":[">=1.166.55, <1.166.59",">=1.166.58, <1.166.59"],"patched":["1.166.59"],"from":["GHSA-g7cv-rxg3-hmpx"],"provenance":"source"},{"ecosystem":"npm","package":"@tanstack/router-cli","vulnerableRanges":[">=1.166.46, <1.166.50",">=1.166.49, <1.166.50"],"patched":["1.166.50"],"from":["GHSA-g7cv-rxg3-hmpx"],"provenance":"source"},{"ecosystem":"npm","package":"@tanstack/router-core","vulnerableRanges":[">=1.169.5, <1.169.9",">=1.169.8, <1.169.9"],"patched":["1.169.9"],"from":["GHSA-g7cv-rxg3-hmpx"],"provenance":"source"},{"ecosystem":"npm","package":"@tanstack/router-devtools","vulnerableRanges":[">=1.166.16, <1.166.20",">=1.166.19, <1.166.20"],"patched":["1.166.20"],"from":["GHSA-g7cv-rxg3-hmpx"],"provenance":"source"},{"ecosystem":"npm","package":"@tanstack/router-devtools-core","vulnerableRanges":[">=1.167.6, <1.167.10",">=1.167.9, <1.167.10"],"patched":["1.167.10"],"from":["GHSA-g7cv-rxg3-hmpx"],"provenance":"source"},{"ecosystem":"npm","package":"@tanstack/router-generator","vulnerableRanges":[">=1.166.45, <1.166.49",">=1.166.48, <1.166.49"],"patched":["1.166.49"],"from":["GHSA-g7cv-rxg3-hmpx"],"provenance":"source"},{"ecosystem":"npm","package":"@tanstack/router-plugin","vulnerableRanges":[">=1.167.38, <1.167.42",">=1.167.41, <1.167.42"],"patched":["1.167.42"],"from":["GHSA-g7cv-rxg3-hmpx"],"provenance":"source"},{"ecosystem":"npm","package":"@tanstack/router-ssr-query-core","vulnerableRanges":[">=1.168.3, <1.168.7",">=1.168.6, <1.168.7"],"patched":["1.168.7"],"from":["GHSA-g7cv-rxg3-hmpx"],"provenance":"source"},{"ecosystem":"npm","package":"@tanstack/router-utils","vulnerableRanges":[">=1.161.11, <1.161.15",">=1.161.14, <1.161.15"],"patched":["1.161.15"],"from":["GHSA-g7cv-rxg3-hmpx"],"provenance":"source"},{"ecosystem":"npm","package":"@tanstack/router-vite-plugin","vulnerableRanges":[">=1.166.53, <1.166.57",">=1.166.56, <1.166.57"],"patched":["1.166.57"],"from":["GHSA-g7cv-rxg3-hmpx"],"provenance":"source"},{"ecosystem":"npm","package":"@tanstack/solid-router","vulnerableRanges":[">=1.169.5, <1.169.9",">=1.169.8, <1.169.9"],"patched":["1.169.9"],"from":["GHSA-g7cv-rxg3-hmpx"],"provenance":"source"},{"ecosystem":"npm","package":"@tanstack/solid-router-devtools","vulnerableRanges":[">=1.166.16, <1.166.20",">=1.166.19, <1.166.20"],"patched":["1.166.20"],"from":["GHSA-g7cv-rxg3-hmpx"],"provenance":"source"},{"ecosystem":"npm","package":"@tanstack/solid-router-ssr-query","vulnerableRanges":[">=1.166.15, <1.166.19",">=1.166.18, <1.166.19"],"patched":["1.166.19"],"from":["GHSA-g7cv-rxg3-hmpx"],"provenance":"source"},{"ecosystem":"npm","package":"@tanstack/solid-start","vulnerableRanges":[">=1.167.65, <1.167.69",">=1.167.68, <1.167.69"],"patched":["1.167.69"],"from":["GHSA-g7cv-rxg3-hmpx"],"provenance":"source"},{"ecosystem":"npm","package":"@tanstack/solid-start-client","vulnerableRanges":[">=1.166.50, <1.166.54",">=1.166.53, <1.166.54"],"patched":["1.166.54"],"from":["GHSA-g7cv-rxg3-hmpx"],"provenance":"source"},{"ecosystem":"npm","package":"@tanstack/solid-start-server","vulnerableRanges":[">=1.166.54, <1.166.58",">=1.166.57, <1.166.58"],"patched":["1.166.58"],"from":["GHSA-g7cv-rxg3-hmpx"],"provenance":"source"},{"ecosystem":"npm","package":"@tanstack/start-client-core","vulnerableRanges":[">=1.168.5, <1.168.9",">=1.168.8, <1.168.9"],"patched":["1.168.9"],"from":["GHSA-g7cv-rxg3-hmpx"],"provenance":"source"},{"ecosystem":"npm","package":"@tanstack/start-fn-stubs","vulnerableRanges":[">=1.161.9, <1.161.13",">=1.161.12, <1.161.13"],"patched":["1.161.13"],"from":["GHSA-g7cv-rxg3-hmpx"],"provenance":"source"},{"ecosystem":"npm","package":"@tanstack/start-plugin-core","vulnerableRanges":[">=1.169.23, <1.169.27",">=1.169.26, <1.169.27"],"patched":["1.169.27"],"from":["GHSA-g7cv-rxg3-hmpx"],"provenance":"source"},{"ecosystem":"npm","package":"@tanstack/start-server-core","vulnerableRanges":[">=1.167.33, <1.167.37",">=1.167.36, <1.167.37"],"patched":["1.167.37"],"from":["GHSA-g7cv-rxg3-hmpx"],"provenance":"source"},{"ecosystem":"npm","package":"@tanstack/start-static-server-functions","vulnerableRanges":[">=1.166.44, <1.166.48",">=1.166.47, <1.166.48"],"patched":["1.166.48"],"from":["GHSA-g7cv-rxg3-hmpx"],"provenance":"source"},{"ecosystem":"npm","package":"@tanstack/start-storage-context","vulnerableRanges":[">=1.166.38, <1.166.42",">=1.166.41, <1.166.42"],"patched":["1.166.42"],"from":["GHSA-g7cv-rxg3-hmpx"],"provenance":"source"},{"ecosystem":"npm","package":"@tanstack/valibot-adapter","vulnerableRanges":[">=1.166.12, <1.166.16",">=1.166.15, <1.166.16"],"patched":["1.166.16"],"from":["GHSA-g7cv-rxg3-hmpx"],"provenance":"source"},{"ecosystem":"npm","package":"@tanstack/virtual-file-routes","vulnerableRanges":[">=1.161.10, <1.161.14",">=1.161.13, <1.161.14"],"patched":["1.161.14"],"from":["GHSA-g7cv-rxg3-hmpx"],"provenance":"source"},{"ecosystem":"npm","package":"@tanstack/vue-router","vulnerableRanges":[">=1.169.5, <1.169.9",">=1.169.8, <1.169.9"],"patched":["1.169.9"],"from":["GHSA-g7cv-rxg3-hmpx"],"provenance":"source"},{"ecosystem":"npm","package":"@tanstack/vue-router-devtools","vulnerableRanges":[">=1.166.16, <1.166.20",">=1.166.19, <1.166.20"],"patched":["1.166.20"],"from":["GHSA-g7cv-rxg3-hmpx"],"provenance":"source"},{"ecosystem":"npm","package":"@tanstack/vue-router-ssr-query","vulnerableRanges":[">=1.166.15, <1.166.19",">=1.166.18, <1.166.19"],"patched":["1.166.19"],"from":["GHSA-g7cv-rxg3-hmpx"],"provenance":"source"},{"ecosystem":"npm","package":"@tanstack/vue-start","vulnerableRanges":[">=1.167.61, <1.167.65",">=1.167.64, <1.167.65"],"patched":["1.167.65"],"from":["GHSA-g7cv-rxg3-hmpx"],"provenance":"source"},{"ecosystem":"npm","package":"@tanstack/vue-start-client","vulnerableRanges":[">=1.166.46, <1.166.50",">=1.166.49, <1.166.50"],"patched":["1.166.50"],"from":["GHSA-g7cv-rxg3-hmpx"],"provenance":"source"},{"ecosystem":"npm","package":"@tanstack/vue-start-server","vulnerableRanges":[">=1.166.50, <1.166.54",">=1.166.53, <1.166.54"],"patched":["1.166.54"],"from":["GHSA-g7cv-rxg3-hmpx"],"provenance":"source"},{"ecosystem":"npm","package":"@tanstack/zod-adapter","vulnerableRanges":[">=1.166.12, <1.166.16",">=1.166.15, <1.166.16"],"patched":["1.166.16"],"from":["GHSA-g7cv-rxg3-hmpx"],"provenance":"source"}],"advisories":[{"id":"GHSA-g7cv-rxg3-hmpx","url":"https://github.com/advisories/GHSA-g7cv-rxg3-hmpx","severity":"CRITICAL","ecosystem":"npm","package":"@tanstack/arktype-adapter","vulnerableRanges":[">=1.166.12, <1.166.16"],"patched":["1.166.16"],"provenance":"source","from":"GHSA"},{"id":"GHSA-g7cv-rxg3-hmpx","url":"https://github.com/advisories/GHSA-g7cv-rxg3-hmpx","severity":"CRITICAL","ecosystem":"npm","package":"@tanstack/eslint-plugin-router","vulnerableRanges":[">=1.161.9, <1.161.13"],"patched":["1.161.13"],"provenance":"source","from":"GHSA"},{"id":"GHSA-g7cv-rxg3-hmpx","url":"https://github.com/advisories/GHSA-g7cv-rxg3-hmpx","severity":"CRITICAL","ecosystem":"npm","package":"@tanstack/eslint-plugin-start","vulnerableRanges":[">=0.0.4, <0.0.8"],"patched":["0.0.8"],"provenance":"source","from":"GHSA"},{"id":"GHSA-g7cv-rxg3-hmpx","url":"https://github.com/advisories/GHSA-g7cv-rxg3-hmpx","severity":"CRITICAL","ecosystem":"npm","package":"@tanstack/history","vulnerableRanges":[">=1.161.9, <1.161.13"],"patched":["1.161.13"],"provenance":"source","from":"GHSA"},{"id":"GHSA-g7cv-rxg3-hmpx","url":"https://github.com/advisories/GHSA-g7cv-rxg3-hmpx","severity":"CRITICAL","ecosystem":"npm","package":"@tanstack/nitro-v2-vite-plugin","vulnerableRanges":[">=1.154.12, <1.154.16"],"patched":["1.154.16"],"provenance":"source","from":"GHSA"},{"id":"GHSA-g7cv-rxg3-hmpx","url":"https://github.com/advisories/GHSA-g7cv-rxg3-hmpx","severity":"CRITICAL","ecosystem":"npm","package":"@tanstack/react-router","vulnerableRanges":[">=1.169.5, <1.169.9"],"patched":["1.169.9"],"provenance":"source","from":"GHSA"},{"id":"GHSA-g7cv-rxg3-hmpx","url":"https://github.com/advisories/GHSA-g7cv-rxg3-hmpx","severity":"CRITICAL","ecosystem":"npm","package":"@tanstack/react-router-devtools","vulnerableRanges":[">=1.166.16, <1.166.20"],"patched":["1.166.20"],"provenance":"source","from":"GHSA"},{"id":"GHSA-g7cv-rxg3-hmpx","url":"https://github.com/advisories/GHSA-g7cv-rxg3-hmpx","severity":"CRITICAL","ecosystem":"npm","package":"@tanstack/react-router-ssr-query","vulnerableRanges":[">=1.166.15, <1.166.19"],"patched":["1.166.19"],"provenance":"source","from":"GHSA"},{"id":"GHSA-g7cv-rxg3-hmpx","url":"https://github.com/advisories/GHSA-g7cv-rxg3-hmpx","severity":"CRITICAL","ecosystem":"npm","package":"@tanstack/react-start","vulnerableRanges":[">=1.167.68, <1.167.72"],"patched":["1.167.72"],"provenance":"source","from":"GHSA"},{"id":"GHSA-g7cv-rxg3-hmpx","url":"https://github.com/advisories/GHSA-g7cv-rxg3-hmpx","severity":"CRITICAL","ecosystem":"npm","package":"@tanstack/react-start-client","vulnerableRanges":[">=1.166.51, <1.166.55"],"patched":["1.166.55"],"provenance":"source","from":"GHSA"},{"id":"GHSA-g7cv-rxg3-hmpx","url":"https://github.com/advisories/GHSA-g7cv-rxg3-hmpx","severity":"CRITICAL","ecosystem":"npm","package":"@tanstack/react-start-rsc","vulnerableRanges":[">=0.0.47, <0.0.51"],"patched":["0.0.51"],"provenance":"source","from":"GHSA"},{"id":"GHSA-g7cv-rxg3-hmpx","url":"https://github.com/advisories/GHSA-g7cv-rxg3-hmpx","severity":"CRITICAL","ecosystem":"npm","package":"@tanstack/react-start-server","vulnerableRanges":[">=1.166.55, <1.166.59"],"patched":["1.166.59"],"provenance":"source","from":"GHSA"},{"id":"GHSA-g7cv-rxg3-hmpx","url":"https://github.com/advisories/GHSA-g7cv-rxg3-hmpx","severity":"CRITICAL","ecosystem":"npm","package":"@tanstack/router-cli","vulnerableRanges":[">=1.166.46, <1.166.50"],"patched":["1.166.50"],"provenance":"source","from":"GHSA"},{"id":"GHSA-g7cv-rxg3-hmpx","url":"https://github.com/advisories/GHSA-g7cv-rxg3-hmpx","severity":"CRITICAL","ecosystem":"npm","package":"@tanstack/router-core","vulnerableRanges":[">=1.169.5, <1.169.9"],"patched":["1.169.9"],"provenance":"source","from":"GHSA"},{"id":"GHSA-g7cv-rxg3-hmpx","url":"https://github.com/advisories/GHSA-g7cv-rxg3-hmpx","severity":"CRITICAL","ecosystem":"npm","package":"@tanstack/router-devtools","vulnerableRanges":[">=1.166.16, <1.166.20"],"patched":["1.166.20"],"provenance":"source","from":"GHSA"},{"id":"GHSA-g7cv-rxg3-hmpx","url":"https://github.com/advisories/GHSA-g7cv-rxg3-hmpx","severity":"CRITICAL","ecosystem":"npm","package":"@tanstack/router-devtools-core","vulnerableRanges":[">=1.167.6, <1.167.10"],"patched":["1.167.10"],"provenance":"source","from":"GHSA"},{"id":"GHSA-g7cv-rxg3-hmpx","url":"https://github.com/advisories/GHSA-g7cv-rxg3-hmpx","severity":"CRITICAL","ecosystem":"npm","package":"@tanstack/router-generator","vulnerableRanges":[">=1.166.45, <1.166.49"],"patched":["1.166.49"],"provenance":"source","from":"GHSA"},{"id":"GHSA-g7cv-rxg3-hmpx","url":"https://github.com/advisories/GHSA-g7cv-rxg3-hmpx","severity":"CRITICAL","ecosystem":"npm","package":"@tanstack/router-plugin","vulnerableRanges":[">=1.167.38, <1.167.42"],"patched":["1.167.42"],"provenance":"source","from":"GHSA"},{"id":"GHSA-g7cv-rxg3-hmpx","url":"https://github.com/advisories/GHSA-g7cv-rxg3-hmpx","severity":"CRITICAL","ecosystem":"npm","package":"@tanstack/router-ssr-query-core","vulnerableRanges":[">=1.168.3, <1.168.7"],"patched":["1.168.7"],"provenance":"source","from":"GHSA"},{"id":"GHSA-g7cv-rxg3-hmpx","url":"https://github.com/advisories/GHSA-g7cv-rxg3-hmpx","severity":"CRITICAL","ecosystem":"npm","package":"@tanstack/router-utils","vulnerableRanges":[">=1.161.11, <1.161.15"],"patched":["1.161.15"],"provenance":"source","from":"GHSA"},{"id":"GHSA-g7cv-rxg3-hmpx","url":"https://github.com/advisories/GHSA-g7cv-rxg3-hmpx","severity":"CRITICAL","ecosystem":"npm","package":"@tanstack/router-vite-plugin","vulnerableRanges":[">=1.166.53, <1.166.57"],"patched":["1.166.57"],"provenance":"source","from":"GHSA"},{"id":"GHSA-g7cv-rxg3-hmpx","url":"https://github.com/advisories/GHSA-g7cv-rxg3-hmpx","severity":"CRITICAL","ecosystem":"npm","package":"@tanstack/solid-router","vulnerableRanges":[">=1.169.5, <1.169.9"],"patched":["1.169.9"],"provenance":"source","from":"GHSA"},{"id":"GHSA-g7cv-rxg3-hmpx","url":"https://github.com/advisories/GHSA-g7cv-rxg3-hmpx","severity":"CRITICAL","ecosystem":"npm","package":"@tanstack/solid-router-devtools","vulnerableRanges":[">=1.166.16, <1.166.20"],"patched":["1.166.20"],"provenance":"source","from":"GHSA"},{"id":"GHSA-g7cv-rxg3-hmpx","url":"https://github.com/advisories/GHSA-g7cv-rxg3-hmpx","severity":"CRITICAL","ecosystem":"npm","package":"@tanstack/solid-router-ssr-query","vulnerableRanges":[">=1.166.15, <1.166.19"],"patched":["1.166.19"],"provenance":"source","from":"GHSA"},{"id":"GHSA-g7cv-rxg3-hmpx","url":"https://github.com/advisories/GHSA-g7cv-rxg3-hmpx","severity":"CRITICAL","ecosystem":"npm","package":"@tanstack/solid-start","vulnerableRanges":[">=1.167.65, <1.167.69"],"patched":["1.167.69"],"provenance":"source","from":"GHSA"},{"id":"GHSA-g7cv-rxg3-hmpx","url":"https://github.com/advisories/GHSA-g7cv-rxg3-hmpx","severity":"CRITICAL","ecosystem":"npm","package":"@tanstack/solid-start-client","vulnerableRanges":[">=1.166.50, <1.166.54"],"patched":["1.166.54"],"provenance":"source","from":"GHSA"},{"id":"GHSA-g7cv-rxg3-hmpx","url":"https://github.com/advisories/GHSA-g7cv-rxg3-hmpx","severity":"CRITICAL","ecosystem":"npm","package":"@tanstack/solid-start-server","vulnerableRanges":[">=1.166.54, <1.166.58"],"patched":["1.166.58"],"provenance":"source","from":"GHSA"},{"id":"GHSA-g7cv-rxg3-hmpx","url":"https://github.com/advisories/GHSA-g7cv-rxg3-hmpx","severity":"CRITICAL","ecosystem":"npm","package":"@tanstack/start-client-core","vulnerableRanges":[">=1.168.5, <1.168.9"],"patched":["1.168.9"],"provenance":"source","from":"GHSA"},{"id":"GHSA-g7cv-rxg3-hmpx","url":"https://github.com/advisories/GHSA-g7cv-rxg3-hmpx","severity":"CRITICAL","ecosystem":"npm","package":"@tanstack/start-fn-stubs","vulnerableRanges":[">=1.161.9, <1.161.13"],"patched":["1.161.13"],"provenance":"source","from":"GHSA"},{"id":"GHSA-g7cv-rxg3-hmpx","url":"https://github.com/advisories/GHSA-g7cv-rxg3-hmpx","severity":"CRITICAL","ecosystem":"npm","package":"@tanstack/start-plugin-core","vulnerableRanges":[">=1.169.23, <1.169.27"],"patched":["1.169.27"],"provenance":"source","from":"GHSA"},{"id":"GHSA-g7cv-rxg3-hmpx","url":"https://github.com/advisories/GHSA-g7cv-rxg3-hmpx","severity":"CRITICAL","ecosystem":"npm","package":"@tanstack/start-server-core","vulnerableRanges":[">=1.167.33, <1.167.37"],"patched":["1.167.37"],"provenance":"source","from":"GHSA"},{"id":"GHSA-g7cv-rxg3-hmpx","url":"https://github.com/advisories/GHSA-g7cv-rxg3-hmpx","severity":"CRITICAL","ecosystem":"npm","package":"@tanstack/start-static-server-functions","vulnerableRanges":[">=1.166.44, <1.166.48"],"patched":["1.166.48"],"provenance":"source","from":"GHSA"},{"id":"GHSA-g7cv-rxg3-hmpx","url":"https://github.com/advisories/GHSA-g7cv-rxg3-hmpx","severity":"CRITICAL","ecosystem":"npm","package":"@tanstack/start-storage-context","vulnerableRanges":[">=1.166.38, <1.166.42"],"patched":["1.166.42"],"provenance":"source","from":"GHSA"},{"id":"GHSA-g7cv-rxg3-hmpx","url":"https://github.com/advisories/GHSA-g7cv-rxg3-hmpx","severity":"CRITICAL","ecosystem":"npm","package":"@tanstack/valibot-adapter","vulnerableRanges":[">=1.166.12, <1.166.16"],"patched":["1.166.16"],"provenance":"source","from":"GHSA"},{"id":"GHSA-g7cv-rxg3-hmpx","url":"https://github.com/advisories/GHSA-g7cv-rxg3-hmpx","severity":"CRITICAL","ecosystem":"npm","package":"@tanstack/virtual-file-routes","vulnerableRanges":[">=1.161.10, <1.161.14"],"patched":["1.161.14"],"provenance":"source","from":"GHSA"},{"id":"GHSA-g7cv-rxg3-hmpx","url":"https://github.com/advisories/GHSA-g7cv-rxg3-hmpx","severity":"CRITICAL","ecosystem":"npm","package":"@tanstack/vue-router","vulnerableRanges":[">=1.169.5, <1.169.9"],"patched":["1.169.9"],"provenance":"source","from":"GHSA"},{"id":"GHSA-g7cv-rxg3-hmpx","url":"https://github.com/advisories/GHSA-g7cv-rxg3-hmpx","severity":"CRITICAL","ecosystem":"npm","package":"@tanstack/vue-router-devtools","vulnerableRanges":[">=1.166.16, <1.166.20"],"patched":["1.166.20"],"provenance":"source","from":"GHSA"},{"id":"GHSA-g7cv-rxg3-hmpx","url":"https://github.com/advisories/GHSA-g7cv-rxg3-hmpx","severity":"CRITICAL","ecosystem":"npm","package":"@tanstack/vue-router-ssr-query","vulnerableRanges":[">=1.166.15, <1.166.19"],"patched":["1.166.19"],"provenance":"source","from":"GHSA"},{"id":"GHSA-g7cv-rxg3-hmpx","url":"https://github.com/advisories/GHSA-g7cv-rxg3-hmpx","severity":"CRITICAL","ecosystem":"npm","package":"@tanstack/vue-start","vulnerableRanges":[">=1.167.61, <1.167.65"],"patched":["1.167.65"],"provenance":"source","from":"GHSA"},{"id":"GHSA-g7cv-rxg3-hmpx","url":"https://github.com/advisories/GHSA-g7cv-rxg3-hmpx","severity":"CRITICAL","ecosystem":"npm","package":"@tanstack/vue-start-client","vulnerableRanges":[">=1.166.46, <1.166.50"],"patched":["1.166.50"],"provenance":"source","from":"GHSA"},{"id":"GHSA-g7cv-rxg3-hmpx","url":"https://github.com/advisories/GHSA-g7cv-rxg3-hmpx","severity":"CRITICAL","ecosystem":"npm","package":"@tanstack/vue-start-server","vulnerableRanges":[">=1.166.50, <1.166.54"],"patched":["1.166.54"],"provenance":"source","from":"GHSA"},{"id":"GHSA-g7cv-rxg3-hmpx","url":"https://github.com/advisories/GHSA-g7cv-rxg3-hmpx","severity":"CRITICAL","ecosystem":"npm","package":"@tanstack/zod-adapter","vulnerableRanges":[">=1.166.12, <1.166.16"],"patched":["1.166.16"],"provenance":"source","from":"GHSA"},{"id":"GHSA-g7cv-rxg3-hmpx","url":"https://github.com/advisories/GHSA-g7cv-rxg3-hmpx","severity":"CRITICAL","ecosystem":"npm","package":"@tanstack/arktype-adapter","vulnerableRanges":[">=1.166.15, <1.166.16"],"patched":["1.166.16"],"provenance":"source","from":"GHSA"},{"id":"GHSA-g7cv-rxg3-hmpx","url":"https://github.com/advisories/GHSA-g7cv-rxg3-hmpx","severity":"CRITICAL","ecosystem":"npm","package":"@tanstack/eslint-plugin-router","vulnerableRanges":[">=1.161.12, <1.161.13"],"patched":["1.161.13"],"provenance":"source","from":"GHSA"},{"id":"GHSA-g7cv-rxg3-hmpx","url":"https://github.com/advisories/GHSA-g7cv-rxg3-hmpx","severity":"CRITICAL","ecosystem":"npm","package":"@tanstack/eslint-plugin-start","vulnerableRanges":[">=0.0.7, <0.0.8"],"patched":["0.0.8"],"provenance":"source","from":"GHSA"},{"id":"GHSA-g7cv-rxg3-hmpx","url":"https://github.com/advisories/GHSA-g7cv-rxg3-hmpx","severity":"CRITICAL","ecosystem":"npm","package":"@tanstack/history","vulnerableRanges":[">=1.161.12, <1.161.13"],"patched":["1.161.13"],"provenance":"source","from":"GHSA"},{"id":"GHSA-g7cv-rxg3-hmpx","url":"https://github.com/advisories/GHSA-g7cv-rxg3-hmpx","severity":"CRITICAL","ecosystem":"npm","package":"@tanstack/nitro-v2-vite-plugin","vulnerableRanges":[">=1.154.15, <1.154.16"],"patched":["1.154.16"],"provenance":"source","from":"GHSA"},{"id":"GHSA-g7cv-rxg3-hmpx","url":"https://github.com/advisories/GHSA-g7cv-rxg3-hmpx","severity":"CRITICAL","ecosystem":"npm","package":"@tanstack/react-router","vulnerableRanges":[">=1.169.8, <1.169.9"],"patched":["1.169.9"],"provenance":"source","from":"GHSA"},{"id":"GHSA-g7cv-rxg3-hmpx","url":"https://github.com/advisories/GHSA-g7cv-rxg3-hmpx","severity":"CRITICAL","ecosystem":"npm","package":"@tanstack/react-router-devtools","vulnerableRanges":[">=1.166.19, <1.166.20"],"patched":["1.166.20"],"provenance":"source","from":"GHSA"},{"id":"GHSA-g7cv-rxg3-hmpx","url":"https://github.com/advisories/GHSA-g7cv-rxg3-hmpx","severity":"CRITICAL","ecosystem":"npm","package":"@tanstack/react-router-ssr-query","vulnerableRanges":[">=1.166.18, <1.166.19"],"patched":["1.166.19"],"provenance":"source","from":"GHSA"},{"id":"GHSA-g7cv-rxg3-hmpx","url":"https://github.com/advisories/GHSA-g7cv-rxg3-hmpx","severity":"CRITICAL","ecosystem":"npm","package":"@tanstack/react-start","vulnerableRanges":[">=1.167.71, <1.167.72"],"patched":["1.167.72"],"provenance":"source","from":"GHSA"},{"id":"GHSA-g7cv-rxg3-hmpx","url":"https://github.com/advisories/GHSA-g7cv-rxg3-hmpx","severity":"CRITICAL","ecosystem":"npm","package":"@tanstack/react-start-client","vulnerableRanges":[">=1.166.54, <1.166.55"],"patched":["1.166.55"],"provenance":"source","from":"GHSA"},{"id":"GHSA-g7cv-rxg3-hmpx","url":"https://github.com/advisories/GHSA-g7cv-rxg3-hmpx","severity":"CRITICAL","ecosystem":"npm","package":"@tanstack/react-start-rsc","vulnerableRanges":[">=0.0.50, <0.0.51"],"patched":["0.0.51"],"provenance":"source","from":"GHSA"},{"id":"GHSA-g7cv-rxg3-hmpx","url":"https://github.com/advisories/GHSA-g7cv-rxg3-hmpx","severity":"CRITICAL","ecosystem":"npm","package":"@tanstack/react-start-server","vulnerableRanges":[">=1.166.58, <1.166.59"],"patched":["1.166.59"],"provenance":"source","from":"GHSA"},{"id":"GHSA-g7cv-rxg3-hmpx","url":"https://github.com/advisories/GHSA-g7cv-rxg3-hmpx","severity":"CRITICAL","ecosystem":"npm","package":"@tanstack/router-cli","vulnerableRanges":[">=1.166.49, <1.166.50"],"patched":["1.166.50"],"provenance":"source","from":"GHSA"},{"id":"GHSA-g7cv-rxg3-hmpx","url":"https://github.com/advisories/GHSA-g7cv-rxg3-hmpx","severity":"CRITICAL","ecosystem":"npm","package":"@tanstack/router-core","vulnerableRanges":[">=1.169.8, <1.169.9"],"patched":["1.169.9"],"provenance":"source","from":"GHSA"},{"id":"GHSA-g7cv-rxg3-hmpx","url":"https://github.com/advisories/GHSA-g7cv-rxg3-hmpx","severity":"CRITICAL","ecosystem":"npm","package":"@tanstack/router-devtools","vulnerableRanges":[">=1.166.19, <1.166.20"],"patched":["1.166.20"],"provenance":"source","from":"GHSA"},{"id":"GHSA-g7cv-rxg3-hmpx","url":"https://github.com/advisories/GHSA-g7cv-rxg3-hmpx","severity":"CRITICAL","ecosystem":"npm","package":"@tanstack/router-devtools-core","vulnerableRanges":[">=1.167.9, <1.167.10"],"patched":["1.167.10"],"provenance":"source","from":"GHSA"},{"id":"GHSA-g7cv-rxg3-hmpx","url":"https://github.com/advisories/GHSA-g7cv-rxg3-hmpx","severity":"CRITICAL","ecosystem":"npm","package":"@tanstack/router-generator","vulnerableRanges":[">=1.166.48, <1.166.49"],"patched":["1.166.49"],"provenance":"source","from":"GHSA"},{"id":"GHSA-g7cv-rxg3-hmpx","url":"https://github.com/advisories/GHSA-g7cv-rxg3-hmpx","severity":"CRITICAL","ecosystem":"npm","package":"@tanstack/router-plugin","vulnerableRanges":[">=1.167.41, <1.167.42"],"patched":["1.167.42"],"provenance":"source","from":"GHSA"},{"id":"GHSA-g7cv-rxg3-hmpx","url":"https://github.com/advisories/GHSA-g7cv-rxg3-hmpx","severity":"CRITICAL","ecosystem":"npm","package":"@tanstack/router-ssr-query-core","vulnerableRanges":[">=1.168.6, <1.168.7"],"patched":["1.168.7"],"provenance":"source","from":"GHSA"},{"id":"GHSA-g7cv-rxg3-hmpx","url":"https://github.com/advisories/GHSA-g7cv-rxg3-hmpx","severity":"CRITICAL","ecosystem":"npm","package":"@tanstack/router-utils","vulnerableRanges":[">=1.161.14, <1.161.15"],"patched":["1.161.15"],"provenance":"source","from":"GHSA"},{"id":"GHSA-g7cv-rxg3-hmpx","url":"https://github.com/advisories/GHSA-g7cv-rxg3-hmpx","severity":"CRITICAL","ecosystem":"npm","package":"@tanstack/router-vite-plugin","vulnerableRanges":[">=1.166.56, <1.166.57"],"patched":["1.166.57"],"provenance":"source","from":"GHSA"},{"id":"GHSA-g7cv-rxg3-hmpx","url":"https://github.com/advisories/GHSA-g7cv-rxg3-hmpx","severity":"CRITICAL","ecosystem":"npm","package":"@tanstack/solid-router","vulnerableRanges":[">=1.169.8, <1.169.9"],"patched":["1.169.9"],"provenance":"source","from":"GHSA"},{"id":"GHSA-g7cv-rxg3-hmpx","url":"https://github.com/advisories/GHSA-g7cv-rxg3-hmpx","severity":"CRITICAL","ecosystem":"npm","package":"@tanstack/solid-router-devtools","vulnerableRanges":[">=1.166.19, <1.166.20"],"patched":["1.166.20"],"provenance":"source","from":"GHSA"},{"id":"GHSA-g7cv-rxg3-hmpx","url":"https://github.com/advisories/GHSA-g7cv-rxg3-hmpx","severity":"CRITICAL","ecosystem":"npm","package":"@tanstack/solid-router-ssr-query","vulnerableRanges":[">=1.166.18, <1.166.19"],"patched":["1.166.19"],"provenance":"source","from":"GHSA"},{"id":"GHSA-g7cv-rxg3-hmpx","url":"https://github.com/advisories/GHSA-g7cv-rxg3-hmpx","severity":"CRITICAL","ecosystem":"npm","package":"@tanstack/solid-start","vulnerableRanges":[">=1.167.68, <1.167.69"],"patched":["1.167.69"],"provenance":"source","from":"GHSA"},{"id":"GHSA-g7cv-rxg3-hmpx","url":"https://github.com/advisories/GHSA-g7cv-rxg3-hmpx","severity":"CRITICAL","ecosystem":"npm","package":"@tanstack/solid-start-client","vulnerableRanges":[">=1.166.53, <1.166.54"],"patched":["1.166.54"],"provenance":"source","from":"GHSA"},{"id":"GHSA-g7cv-rxg3-hmpx","url":"https://github.com/advisories/GHSA-g7cv-rxg3-hmpx","severity":"CRITICAL","ecosystem":"npm","package":"@tanstack/solid-start-server","vulnerableRanges":[">=1.166.57, <1.166.58"],"patched":["1.166.58"],"provenance":"source","from":"GHSA"},{"id":"GHSA-g7cv-rxg3-hmpx","url":"https://github.com/advisories/GHSA-g7cv-rxg3-hmpx","severity":"CRITICAL","ecosystem":"npm","package":"@tanstack/start-client-core","vulnerableRanges":[">=1.168.8, <1.168.9"],"patched":["1.168.9"],"provenance":"source","from":"GHSA"},{"id":"GHSA-g7cv-rxg3-hmpx","url":"https://github.com/advisories/GHSA-g7cv-rxg3-hmpx","severity":"CRITICAL","ecosystem":"npm","package":"@tanstack/start-fn-stubs","vulnerableRanges":[">=1.161.12, <1.161.13"],"patched":["1.161.13"],"provenance":"source","from":"GHSA"},{"id":"GHSA-g7cv-rxg3-hmpx","url":"https://github.com/advisories/GHSA-g7cv-rxg3-hmpx","severity":"CRITICAL","ecosystem":"npm","package":"@tanstack/start-plugin-core","vulnerableRanges":[">=1.169.26, <1.169.27"],"patched":["1.169.27"],"provenance":"source","from":"GHSA"},{"id":"GHSA-g7cv-rxg3-hmpx","url":"https://github.com/advisories/GHSA-g7cv-rxg3-hmpx","severity":"CRITICAL","ecosystem":"npm","package":"@tanstack/start-server-core","vulnerableRanges":[">=1.167.36, <1.167.37"],"patched":["1.167.37"],"provenance":"source","from":"GHSA"},{"id":"GHSA-g7cv-rxg3-hmpx","url":"https://github.com/advisories/GHSA-g7cv-rxg3-hmpx","severity":"CRITICAL","ecosystem":"npm","package":"@tanstack/start-static-server-functions","vulnerableRanges":[">=1.166.47, <1.166.48"],"patched":["1.166.48"],"provenance":"source","from":"GHSA"},{"id":"GHSA-g7cv-rxg3-hmpx","url":"https://github.com/advisories/GHSA-g7cv-rxg3-hmpx","severity":"CRITICAL","ecosystem":"npm","package":"@tanstack/start-storage-context","vulnerableRanges":[">=1.166.41, <1.166.42"],"patched":["1.166.42"],"provenance":"source","from":"GHSA"},{"id":"GHSA-g7cv-rxg3-hmpx","url":"https://github.com/advisories/GHSA-g7cv-rxg3-hmpx","severity":"CRITICAL","ecosystem":"npm","package":"@tanstack/valibot-adapter","vulnerableRanges":[">=1.166.15, <1.166.16"],"patched":["1.166.16"],"provenance":"source","from":"GHSA"},{"id":"GHSA-g7cv-rxg3-hmpx","url":"https://github.com/advisories/GHSA-g7cv-rxg3-hmpx","severity":"CRITICAL","ecosystem":"npm","package":"@tanstack/virtual-file-routes","vulnerableRanges":[">=1.161.13, <1.161.14"],"patched":["1.161.14"],"provenance":"source","from":"GHSA"},{"id":"GHSA-g7cv-rxg3-hmpx","url":"https://github.com/advisories/GHSA-g7cv-rxg3-hmpx","severity":"CRITICAL","ecosystem":"npm","package":"@tanstack/vue-router","vulnerableRanges":[">=1.169.8, <1.169.9"],"patched":["1.169.9"],"provenance":"source","from":"GHSA"},{"id":"GHSA-g7cv-rxg3-hmpx","url":"https://github.com/advisories/GHSA-g7cv-rxg3-hmpx","severity":"CRITICAL","ecosystem":"npm","package":"@tanstack/vue-router-devtools","vulnerableRanges":[">=1.166.19, <1.166.20"],"patched":["1.166.20"],"provenance":"source","from":"GHSA"},{"id":"GHSA-g7cv-rxg3-hmpx","url":"https://github.com/advisories/GHSA-g7cv-rxg3-hmpx","severity":"CRITICAL","ecosystem":"npm","package":"@tanstack/vue-router-ssr-query","vulnerableRanges":[">=1.166.18, <1.166.19"],"patched":["1.166.19"],"provenance":"source","from":"GHSA"},{"id":"GHSA-g7cv-rxg3-hmpx","url":"https://github.com/advisories/GHSA-g7cv-rxg3-hmpx","severity":"CRITICAL","ecosystem":"npm","package":"@tanstack/vue-start","vulnerableRanges":[">=1.167.64, <1.167.65"],"patched":["1.167.65"],"provenance":"source","from":"GHSA"},{"id":"GHSA-g7cv-rxg3-hmpx","url":"https://github.com/advisories/GHSA-g7cv-rxg3-hmpx","severity":"CRITICAL","ecosystem":"npm","package":"@tanstack/vue-start-client","vulnerableRanges":[">=1.166.49, <1.166.50"],"patched":["1.166.50"],"provenance":"source","from":"GHSA"},{"id":"GHSA-g7cv-rxg3-hmpx","url":"https://github.com/advisories/GHSA-g7cv-rxg3-hmpx","severity":"CRITICAL","ecosystem":"npm","package":"@tanstack/vue-start-server","vulnerableRanges":[">=1.166.53, <1.166.54"],"patched":["1.166.54"],"provenance":"source","from":"GHSA"},{"id":"GHSA-g7cv-rxg3-hmpx","url":"https://github.com/advisories/GHSA-g7cv-rxg3-hmpx","severity":"CRITICAL","ecosystem":"npm","package":"@tanstack/zod-adapter","vulnerableRanges":[">=1.166.15, <1.166.16"],"patched":["1.166.16"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2026-29352","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-29352","exploited":true,"exploitedSince":"2026-05-27","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":10,"skipped":2,"earliest":"2026-05-12","earliestUrl":"https://github.com/ry-allan/tanstack-compromise-checker","repos":[{"name":"Intrudify/mini-shai-hulud-scanner","url":"https://github.com/Intrudify/mini-shai-hulud-scanner","stars":3,"created":"2026-05-13"},{"name":"fabriziosalmi/tanstack-compromise-checker","url":"https://github.com/fabriziosalmi/tanstack-compromise-checker","stars":2,"created":"2026-05-16"},{"name":"qi-scape/scan-shai-hulud","url":"https://github.com/qi-scape/scan-shai-hulud","stars":1,"created":"2026-05-12"},{"name":"shayr1/shai-hulud-scan","url":"https://github.com/shayr1/shai-hulud-scan","stars":1,"created":"2026-05-12"},{"name":"nkopylov/tanscript-exploit-check","url":"https://github.com/nkopylov/tanscript-exploit-check","stars":1,"created":"2026-05-18"}]},"first":{"date":"2026-05-12","source":"PoC-in-GitHub","url":"https://github.com/ry-allan/tanstack-compromise-checker"},"provenance":"source"},"exploitRefs":["https://tanstack.com/blog/npm-supply-chain-compromise-postmortem","https://www.stepsecurity.io/blog/mini-shai-hulud-is-back-a-self-spreading-supply-chain-attack-hits-the-npm-ecosystem"],"flow":[{"stage":"exploitation","techniques":["T1195.002"],"provenance":"ai"},{"stage":"primary","techniques":["T1528"],"provenance":"ai"}],"timeline":[{"date":"2026-05-12","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45321","provenance":"source"},{"date":"2026-05-12","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/ry-allan/tanstack-compromise-checker","provenance":"source"},{"date":"2026-05-27","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://nefariousplan.com/posts/tanstack-cve-2026-45321-bundle-size-poisoned-release-restored","provenance":"source"},{"date":"2026-05-27","kind":"kev","label":"Added to CISA KEV (known ransomware use)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2026-05-27","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-29352","provenance":"source"}],"speed":{"daysToPublicExploit":0,"firstExploitFrom":"PoC-in-GitHub","daysToKev":15},"priority":{"score":86.3,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":5.0,"detail":"added 157 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":17.68,"detail":"percentile 0.8841"},{"name":"Named in threat reports","points":3.87,"detail":"1 report"},{"name":"Public exploit code","points":5.0,"detail":"2 NVD references tagged Exploit; 10 PoC-in-GitHub repos"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.72,"detail":"base score 9.6"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"packageHistory":[{"cve":"CVE-2026-45321","published":"2026-05-12","fixed":"1.167.72","kev":true},{"cve":"CVE-2026-102989","published":"2026-10-13","fixed":"1.168.60","kev":false,"link":{"from":"CVE-2026-45321","to":"CVE-2026-102989","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"npm:@tanstack/react-start","fromFixed":"1.167.72","toFixed":"1.168.60","daysApart":154},{"kind":"version-step","provenance":"source","package":"npm:@tanstack/solid-start","fromFixed":"1.167.69","toFixed":"1.168.57","daysApart":154}]}}],"package":"npm:@tanstack/react-start"}}