# CVE-2024-24558: TanStack react-query-next-experimental cross-site scripting in server-side rendering

Source: https://junglewise.ai/threats/cve-2024-24558-tanstack-react-query-next-experimental-cross-site-scripting-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2024-01-30. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2024-24558 · Severity: low · CVSS 3.1 · Published 2024-01-30

TanStack's react-query-next-experimental is a library used to manage server-side rendering of data queries in Next.js applications. The library fails to properly escape untrusted input when rendering HTML pages on the server, allowing attackers to inject malicious JavaScript that executes in the browsers of affected users. This could lead to session theft, credential capture, or malware distribution to application visitors.

Vendors: [npm](https://junglewise.ai/threats/vendors/npm), [TanStack](https://junglewise.ai/threats/vendors/tanstack).

## Quick answers

**Is CVE-2024-24558 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2024-24558 being exploited in the wild.

**How severe is CVE-2024-24558?** Low severity, with a CVSS score of 3.1, published 30 January 2024.

**Which products and versions are affected?** @tanstack/react-query-next-experimental (npm) SEMVER:introduced=5.0.0,fixed=5.18.0; TanStack React-Query-Next-Experimental 5.0.0 to 5.17.x.

**Is there a fix for CVE-2024-24558?** Yes. @tanstack/react-query-next-experimental (npm): upgrade to 5.18.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2024-24558 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2024-24558?** Check whether you run @tanstack/react-query-next-experimental (npm) or TanStack React-Query-Next-Experimental at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @tanstack/react-query-next-experimental (npm): upgrade to 5.18.0 or later

  ```sh
  npm install @tanstack/react-query-next-experimental@5.18.0
  ```


## Technical details

The vulnerability is a reflected cross-site scripting (XSS) vulnerability in @tanstack/react-query-next-experimental affecting versions 5.0.0 through 5.17.x. The root cause is improper neutralization of user-controllable input during server-side HTML rendering (CWE-79). An attacker can inject malicious input through query parameters or API endpoints, which is then rendered unsanitized into the HTML response. The attack requires no authentication or user interaction; the attacker only needs to craft a malicious URL or control an endpoint response. Exploitation allows arbitrary JavaScript execution in victim browsers with the privileges of the vulnerable application. The vendor patched this issue in version 5.18.0 by implementing proper input escaping.

## Affected products

- TanStack react-query-next-experimental 5.0.0 to 5.17.x

## Identifiers

- CVE-2024-24558
- GHSA-997g-27x8-43rf

## Timeline

- 2024-01-30: disclosed
- 2024-01-30: patched: Fixed in version 5.18.0

## References

- [https://github.com/TanStack/query/security/advisories/GHSA-997g-27x8-43rf](https://github.com/TanStack/query/security/advisories/GHSA-997g-27x8-43rf)