Executive brief
TanStack devtools-vite is a development tool used by developers during local application building and debugging. A command injection vulnerability in the package installation function allows a local attacker to execute arbitrary shell commands on the developer's machine, potentially compromising the development environment and any systems it can access.
Technical details
The vulnerability is an OS command injection flaw in the installPackage function of packages/devtools-bundler-core/src/package-manager.ts. The packageName argument is insufficiently sanitized, allowing attackers to inject shell commands that execute with the privileges of the local developer. The attack requires local access to the development environment and involves manipulation of devtools events. While exploitation is noted as difficult and requiring high complexity, a proof-of-concept has been publicly disclosed. Patches are not yet available as the project has not responded to the early disclosure notification.
Affected products
- TanStack devtools-vite 0.7.0
Timeline
- 2026-08-24: disclosed: Vulnerability published and proof-of-concept made public
- 2026-08-24: other: Project informed early through issue report but has not responded