Executive brief
TanStack's react-query-next-experimental is a library used to manage server-side rendering of data queries in Next.js applications. The library fails to properly escape untrusted input when rendering HTML pages on the server, allowing attackers to inject malicious JavaScript that executes in the browsers of affected users. This could lead to session theft, credential capture, or malware distribution to application visitors.
Technical details
The vulnerability is a reflected cross-site scripting (XSS) vulnerability in @tanstack/react-query-next-experimental affecting versions 5.0.0 through 5.17.x. The root cause is improper neutralization of user-controllable input during server-side HTML rendering (CWE-79). An attacker can inject malicious input through query parameters or API endpoints, which is then rendered unsanitized into the HTML response. The attack requires no authentication or user interaction; the attacker only needs to craft a malicious URL or control an endpoint response. Exploitation allows arbitrary JavaScript execution in victim browsers with the privileges of the vulnerable application. The vendor patched this issue in version 5.18.0 by implementing proper input escaping.
Affected products
- TanStack react-query-next-experimental 5.0.0 to 5.17.x
Timeline
- 2024-01-30: disclosed
- 2024-01-30: patched: Fixed in version 5.18.0