CVE-2024-24558 react-query-streamed-hydration xss
An attacker can execute arbitrary scripts in the browser via malicious input in the TanStack Query Next.js experimental package.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-24558?
CVE-2024-24558 is a high-severity cross-site scripting vulnerability in TanStack query, published on 30 Jan 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
TanStack Query supplies asynchronous state management, server-state utilities and data fetching for the web. The `@tanstack/react-query-next-experimental` NPM package is vulnerable to a cross-site scripting vulnerability. To exploit this, an attacker would need to either inject malicious input or arrange to have malicious input be returned from an endpoint. To fix this issue, please update to version 5.18.0 or later.
Weakness: CWE-79
Which versions are affected by CVE-2024-24558?
2 open source packages ship an affected version, including @tanstack/react-query-next-experimental. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
@tanstack/react-query-next-experimental npm | From 5.0.0 | 5.18.0 |
@tanstack/react-query-next-experimental npm | From 5.0.0 | 5.18.0 |
Products include Tanstack React-Query-Next-Experimental.
How do I fix CVE-2024-24558?
Upgrade @tanstack/react-query-next-experimental to 5.18.0 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2024-24558 being exploited?
There is no known exploitation of CVE-2024-24558 in the wild and no public exploit code.
Sources
Also known as GHSA-997g-27x8-43rf.