Executive brief
TanStack DB, a reactive client-side data store, is vulnerable to a security flaw in how it handles data queries. An attacker can use specially crafted query aliases to modify the fundamental structure of JavaScript objects within the application's memory. This could allow an attacker to interfere with application logic or potentially gain unauthorized control over how data is processed.
Technical details
A prototype pollution vulnerability exists in TanStack DB versions up to 0.6.8 within the `select` function of `src/query/compiler/select.ts`. The vulnerability stems from improper sanitization of dot-separated alias paths in the Alias Path Handler. When processing query aliases, the compiler splits the path and traverses the object structure without filtering dangerous segments such as `__proto__`, `constructor`, or `prototype`. A remote attacker with the ability to influence query parameters can provide an alias like `__proto__.polluted`, allowing them to write properties directly to `Object.prototype`. This can lead to global state manipulation or denial of service. The issue is addressed in the patch `ac09b1177a100eafa85cba3cd09dd1f53f933ded` by introducing validation that rejects unsafe alias segments.
Affected products
- TanStack db up to 0.6.8
Timeline
- 2026-06-11: disclosed: Issue reported on GitHub
- 2026-06-26: patched: Fix merged into main branch
- 2026-07-13: advisory: CVE published