CVE-2026-102989

Summary

A cross-site scripting vulnerability in TanStack Router allows unauthenticated attackers to inject malicious HTML into server-function responses, potentially enabling them to execute arbitrary JavaScript in the context of authenticated users' browsers. This occurs when attacker-controlled middleware state reaches error paths and response-shaped objects are accepted as HTTP responses.

Exploitability

The exploit is relatively straightforward as it requires only a crafted server-function URL that can be accessed by any visitor, with no authentication required to trigger the vulnerability.

Blast radius

The impact could be severe as attackers could inject malicious scripts that access same-origin data and issue requests with visitors' authority, potentially leading to account takeover or data exfiltration.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to @tanstack/start-server-core 1.169.39, @tanstack/react-start 1.168.60, @tanstack/solid-start 1.168.57, and @tanstack/vue-start 1.168.56 immediately.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.