{"schema_version":1,"title":"TanStack vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 7 vulnerabilities in TanStack: 0 in the last 7 days and 1 in the last 90 days, 2 of them critical and 2 exploited in the wild. The most recent, CVE-2026-78177, was published on 24 August 2026. 1 technology has a page of its own.","url":"https://junglewise.ai/threats/vendors/tanstack","json_url":"https://junglewise.ai/threats/vendors/tanstack.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/vendors/tanstack","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"vendor","counts":{"high":0,"all_time":7,"critical":2,"exploited":2,"last_7_days":0,"last_30_days":0,"last_90_days":1,"last_365_days":5},"latest":[{"cve":"CVE-2026-78177","cvss":4.5,"epss":0.009,"slug":"cve-2026-78177-tanstack-devtools-vite-command-injection-in-package-manager","title":"TanStack devtools-vite command injection in package manager","severity":"medium","exploited":false,"published_at":"2026-08-24T03:16:40.473+00:00","url":"https://junglewise.ai/threats/cve-2026-78177-tanstack-devtools-vite-command-injection-in-package-manager"},{"cve":"CVE-2026-8398","cvss":9.8,"epss":0.0004,"slug":"cve-2026-8398-avb-disc-soft-daemon-tools-lite-supply-chain-compromise","title":"AVB Disc Soft DAEMON Tools Lite supply chain compromise","severity":"critical","exploited":true,"published_at":"2026-05-15T09:16:17.653+00:00","url":"https://junglewise.ai/threats/cve-2026-8398-avb-disc-soft-daemon-tools-lite-supply-chain-compromise"},{"cvss":6.3,"slug":"tanstack-start-type-confusion-in-server-function-deserialization-40e9dc5b","title":"TanStack Start type confusion in server function deserialization","severity":"medium","exploited":false,"published_at":"2026-05-14T16:37:10+00:00","url":"https://junglewise.ai/threats/tanstack-start-type-confusion-in-server-function-deserialization-40e9dc5b"},{"cvss":4,"slug":"tanstack-start-server-core-type-confusion-in-request-deserialization-53e6cf74","title":"TanStack Start Server Core type confusion in request deserialization","severity":"medium","exploited":false,"published_at":"2026-05-14T16:37:10+00:00","url":"https://junglewise.ai/threats/tanstack-start-server-core-type-confusion-in-request-deserialization-53e6cf74"},{"cve":"CVE-2026-45321","cvss":9.6,"epss":0.0105,"slug":"cve-2026-45321-tanstack-npm-packages-supply-chain-compromise-via-github-actions","title":"TanStack npm packages supply chain compromise via GitHub Actions OIDC hijacking","severity":"critical","exploited":true,"published_at":"2026-05-12T01:16:46.82+00:00","url":"https://junglewise.ai/threats/cve-2026-45321-tanstack-npm-packages-supply-chain-compromise-via-github-actions"},{"cve":"CVE-2024-57068","cvss":3.1,"epss":0.0041,"slug":"cve-2024-57068-tanstack-form-core-prototype-pollution-in-mutatemergedeep","title":"TanStack form-core prototype pollution in mutateMergeDeep","severity":"low","exploited":false,"published_at":"2025-02-06T06:31:25+00:00","url":"https://junglewise.ai/threats/cve-2024-57068-tanstack-form-core-prototype-pollution-in-mutatemergedeep"},{"cve":"CVE-2024-24558","cvss":3.1,"epss":0.0039,"slug":"cve-2024-24558-tanstack-react-query-next-experimental-cross-site-scripting-in","title":"TanStack react-query-next-experimental cross-site scripting in server-side rendering","severity":"low","exploited":false,"published_at":"2024-01-30T20:57:22+00:00","url":"https://junglewise.ai/threats/cve-2024-24558-tanstack-react-query-next-experimental-cross-site-scripting-in"}],"vendor":{"hub":true,"name":"TanStack","slug":"tanstack","homepage":"https://tanstack.com/","description":"TanStack is an open-source software organization that maintains a suite of libraries for web development, including tools for data fetching, routing, and table management.","url":"https://junglewise.ai/threats/vendors/tanstack"},"weekly":[{"week":"2026-06-29","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-06","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-13","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-20","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-27","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-03","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-10","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0}],"most_severe":[{"cve":"CVE-2026-8398","cvss":9.8,"epss":0.0004,"slug":"cve-2026-8398-avb-disc-soft-daemon-tools-lite-supply-chain-compromise","title":"AVB Disc Soft DAEMON Tools Lite supply chain compromise","severity":"critical","exploited":true,"published_at":"2026-05-15T09:16:17.653+00:00","url":"https://junglewise.ai/threats/cve-2026-8398-avb-disc-soft-daemon-tools-lite-supply-chain-compromise"},{"cve":"CVE-2026-45321","cvss":9.6,"epss":0.0105,"slug":"cve-2026-45321-tanstack-npm-packages-supply-chain-compromise-via-github-actions","title":"TanStack npm packages supply chain compromise via GitHub Actions OIDC hijacking","severity":"critical","exploited":true,"published_at":"2026-05-12T01:16:46.82+00:00","url":"https://junglewise.ai/threats/cve-2026-45321-tanstack-npm-packages-supply-chain-compromise-via-github-actions"},{"cvss":6.3,"slug":"tanstack-start-type-confusion-in-server-function-deserialization-40e9dc5b","title":"TanStack Start type confusion in server function deserialization","severity":"medium","exploited":false,"published_at":"2026-05-14T16:37:10+00:00","url":"https://junglewise.ai/threats/tanstack-start-type-confusion-in-server-function-deserialization-40e9dc5b"},{"cve":"CVE-2026-78177","cvss":4.5,"epss":0.009,"slug":"cve-2026-78177-tanstack-devtools-vite-command-injection-in-package-manager","title":"TanStack devtools-vite command injection in package manager","severity":"medium","exploited":false,"published_at":"2026-08-24T03:16:40.473+00:00","url":"https://junglewise.ai/threats/cve-2026-78177-tanstack-devtools-vite-command-injection-in-package-manager"},{"cvss":4,"slug":"tanstack-start-server-core-type-confusion-in-request-deserialization-53e6cf74","title":"TanStack Start Server Core type confusion in request deserialization","severity":"medium","exploited":false,"published_at":"2026-05-14T16:37:10+00:00","url":"https://junglewise.ai/threats/tanstack-start-server-core-type-confusion-in-request-deserialization-53e6cf74"},{"cve":"CVE-2024-57068","cvss":3.1,"epss":0.0041,"slug":"cve-2024-57068-tanstack-form-core-prototype-pollution-in-mutatemergedeep","title":"TanStack form-core prototype pollution in mutateMergeDeep","severity":"low","exploited":false,"published_at":"2025-02-06T06:31:25+00:00","url":"https://junglewise.ai/threats/cve-2024-57068-tanstack-form-core-prototype-pollution-in-mutatemergedeep"},{"cve":"CVE-2024-24558","cvss":3.1,"epss":0.0039,"slug":"cve-2024-24558-tanstack-react-query-next-experimental-cross-site-scripting-in","title":"TanStack react-query-next-experimental cross-site scripting in server-side rendering","severity":"low","exploited":false,"published_at":"2024-01-30T20:57:22+00:00","url":"https://junglewise.ai/threats/cve-2024-24558-tanstack-react-query-next-experimental-cross-site-scripting-in"}],"generated_at":"2026-09-26T09:11:00.170868+00:00","technologies":[{"name":"TanStack React-Router","slug":"react-router","vulnerabilities":13,"url":"https://junglewise.ai/threats/technologies/react-router"}]}