{"answers":{"affected":"40 open source packages ship an affected version, including @tanstack/arktype-adapter, @tanstack/eslint-plugin-router and @tanstack/eslint-plugin-start. It affects 171 products.","exploited":"Yes. Attackers have exploited CVE-2026-45321 in the wild since at least 27 May 2026, including in ransomware campaigns.","fix":"Upgrade @tanstack/arktype-adapter to 1.166.16 or later. US federal agencies must fix it by 10 Jun 2026.","what":"CVE-2026-45321 is a critical vulnerability in @tanstack arktype-adapter, published on 12 May 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link."},"fix_prompt":"Check this codebase for CVE-2026-45321 and fix it if it is affected.\n\nWhat it is: CVE-2026-45321 is a critical vulnerability in @tanstack arktype-adapter, published on 12 May 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.\nExploitation: Yes. Attackers have exploited CVE-2026-45321 in the wild since at least 27 May 2026, including in ransomware campaigns.\n\nAffected packages and fixed versions:\n- @tanstack/arktype-adapter (npm): affected from 1.166.12; fixed in 1.166.16\n- @tanstack/arktype-adapter (npm): affected from 1.166.12; fixed in 1.166.16\n- @tanstack/arktype-adapter (npm): affected from 1.166.15; fixed in 1.166.16\n- @tanstack/arktype-adapter (npm): affected from 1.166.15; fixed in 1.166.16\n- @tanstack/eslint-plugin-router (npm): affected from 1.161.12; fixed in 1.161.13\n- @tanstack/eslint-plugin-router (npm): affected from 1.161.12; fixed in 1.161.13\n- @tanstack/eslint-plugin-router (npm): affected from 1.161.9; fixed in 1.161.13\n- @tanstack/eslint-plugin-router (npm): affected from 1.161.9; fixed in 1.161.13\n- @tanstack/eslint-plugin-start (npm): affected from 0.0.4; fixed in 0.0.8\n- @tanstack/eslint-plugin-start (npm): affected from 0.0.4; fixed in 0.0.8\n- @tanstack/eslint-plugin-start (npm): affected from 0.0.7; fixed in 0.0.8\n- @tanstack/eslint-plugin-start (npm): affected from 0.0.7; fixed in 0.0.8\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-45321/ (Markdown: https://insights.sbomify.com/CVE-2026-45321/index.md)","id":"CVE-2026-45321","markdown":"https://insights.sbomify.com/CVE-2026-45321/index.md","name":"CVE-2026-45321","record":{"aliases":["GHSA-g7cv-rxg3-hmpx"],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["data_read","account_takeover"],"network_reachable":"yes","non_default_config":false,"product_category":"TanStack npm packages","requires_auth":"none","summary":"Attackers published malicious versions of TanStack npm packages to steal cloud credentials, GitHub tokens, and SSH keys from users installing them.","user_interaction":"required","vuln_class":"supply_chain"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[{"product":"supersurkhet\\/cli","vendor":"abhishake1"},{"product":"supersurkhet\\/sdk","vendor":"abhishake1"},{"product":"taskflow-corp\\/cli","vendor":"abhishake1"},{"product":"agentwork-cli","vendor":"agentworkhq"},{"product":"ml-toolkit-ts","vendor":"antoinebcx"},{"product":"ml-toolkit-ts\\/preprocessing","vendor":"antoinebcx"},{"product":"ml-toolkit-ts\\/xgboost","vendor":"antoinebcx"},{"product":"beproduct\\/nestjs-auth","vendor":"beproduct"},{"product":"git-git-git","vendor":"christianalares"},{"product":"git_branch_selector","vendor":"christianalares"},{"product":"nextmove-mcp","vendor":"christianalares"},{"product":"tolka\\/cli","vendor":"christianalares"},{"product":"dirigible-ai\\/sdk","vendor":"dirigible"},{"product":"guardrails_ai","vendor":"guardrailsai"},{"product":"tallyui\\/components","vendor":"kilbot"},{"product":"tallyui\\/connector-medusa","vendor":"kilbot"},{"product":"tallyui\\/connector-shopify","vendor":"kilbot"},{"product":"tallyui\\/connector-vendure","vendor":"kilbot"},{"product":"tallyui\\/connector-woocommerce","vendor":"kilbot"},{"product":"tallyui\\/core","vendor":"kilbot"},{"product":"tallyui\\/database","vendor":"kilbot"},{"product":"tallyui\\/pos","vendor":"kilbot"},{"product":"tallyui\\/storage-sqlite","vendor":"kilbot"},{"product":"tallyui\\/theme","vendor":"kilbot"},{"product":"opensearch","vendor":"linuxfoundation"},{"product":"draftauth\\/client","vendor":"matheuspergoli"},{"product":"draftauth\\/core","vendor":"matheuspergoli"},{"product":"draftlab\\/auth","vendor":"matheuspergoli"},{"product":"draftlab\\/auth-router","vendor":"matheuspergoli"},{"product":"draftlab\\/db","vendor":"matheuspergoli"},{"product":"simple_type-safe_actions","vendor":"matheuspergoli"},{"product":"mesadev\\/rest","vendor":"mesa"},{"product":"mesadev\\/saguaro","vendor":"mesa"},{"product":"mesadev\\/sdk","vendor":"mesa"},{"product":"mistralai","vendor":"mistral"},{"product":"mistralai\\/mistralai","vendor":"mistral"},{"product":"mistralai\\/mistralai-azure","vendor":"mistral"},{"product":"mistralai\\/mistralai-gcp","vendor":"mistral"},{"product":"cmux-agent-mcp","vendor":"multiagentcognition"},{"product":"cross-stitch","vendor":"neilcochran"},{"product":"squawk\\/airports","vendor":"neilcochran"},{"product":"squawk\\/airspace","vendor":"neilcochran"},{"product":"squawk\\/airspace-data","vendor":"neilcochran"},{"product":"squawk\\/airway-data","vendor":"neilcochran"},{"product":"squawk\\/airways","vendor":"neilcochran"},{"product":"squawk\\/fix-data","vendor":"neilcochran"},{"product":"squawk\\/fixes","vendor":"neilcochran"},{"product":"squawk\\/flight-math","vendor":"neilcochran"},{"product":"squawk\\/flightplan","vendor":"neilcochran"},{"product":"squawk\\/geo","vendor":"neilcochran"},{"product":"squawk\\/icao-registry","vendor":"neilcochran"},{"product":"squawk\\/icao-registry-data","vendor":"neilcochran"},{"product":"squawk\\/mcp","vendor":"neilcochran"},{"product":"squawk\\/navaid-data","vendor":"neilcochran"},{"product":"squawk\\/navaids","vendor":"neilcochran"},{"product":"squawk\\/notams","vendor":"neilcochran"},{"product":"squawk\\/procedure-data","vendor":"neilcochran"},{"product":"squawk\\/procedures","vendor":"neilcochran"},{"product":"squawk\\/types","vendor":"neilcochran"},{"product":"squawk\\/units","vendor":"neilcochran"},{"product":"squawk\\/weather","vendor":"neilcochran"},{"product":"ts-dna","vendor":"neilcochran"},{"product":"wot-api","vendor":"neilcochran"},{"product":"tanstack\\/arktype-adapter","vendor":"tanstack"},{"product":"tanstack\\/eslint-plugin-router","vendor":"tanstack"},{"product":"tanstack\\/eslint-plugin-start","vendor":"tanstack"},{"product":"tanstack\\/history","vendor":"tanstack"},{"product":"tanstack\\/nitro-v2-vite-plugin","vendor":"tanstack"},{"product":"tanstack\\/react-router","vendor":"tanstack"},{"product":"tanstack\\/react-router-devtools","vendor":"tanstack"},{"product":"tanstack\\/react-router-ssr-query","vendor":"tanstack"},{"product":"tanstack\\/react-start","vendor":"tanstack"},{"product":"tanstack\\/react-start-client","vendor":"tanstack"},{"product":"tanstack\\/react-start-rsc","vendor":"tanstack"},{"product":"tanstack\\/react-start-server","vendor":"tanstack"},{"product":"tanstack\\/router-cli","vendor":"tanstack"},{"product":"tanstack\\/router-core","vendor":"tanstack"},{"product":"tanstack\\/router-devtools","vendor":"tanstack"},{"product":"tanstack\\/router-devtools-core","vendor":"tanstack"},{"product":"tanstack\\/router-generator","vendor":"tanstack"},{"product":"tanstack\\/router-plugin","vendor":"tanstack"},{"product":"tanstack\\/router-ssr-query-core","vendor":"tanstack"},{"product":"tanstack\\/router-utils","vendor":"tanstack"},{"product":"tanstack\\/router-vite-plugin","vendor":"tanstack"},{"product":"tanstack\\/solid-router","vendor":"tanstack"},{"product":"tanstack\\/solid-router-devtools","vendor":"tanstack"},{"product":"tanstack\\/solid-router-ssr-query","vendor":"tanstack"},{"product":"tanstack\\/solid-start","vendor":"tanstack"},{"product":"tanstack\\/solid-start-client","vendor":"tanstack"},{"product":"tanstack\\/solid-start-server","vendor":"tanstack"},{"product":"tanstack\\/start-client-core","vendor":"tanstack"},{"product":"tanstack\\/start-fn-stubs","vendor":"tanstack"},{"product":"tanstack\\/start-plugin-core","vendor":"tanstack"},{"product":"tanstack\\/start-server-core","vendor":"tanstack"},{"product":"tanstack\\/start-static-server-functions","vendor":"tanstack"},{"product":"tanstack\\/start-storage-context","vendor":"tanstack"},{"product":"tanstack\\/valibot-adapter","vendor":"tanstack"},{"product":"tanstack\\/virtual-file-routes","vendor":"tanstack"},{"product":"tanstack\\/vue-router","vendor":"tanstack"},{"product":"tanstack\\/vue-router-devtools","vendor":"tanstack"},{"product":"tanstack\\/vue-router-ssr-query","vendor":"tanstack"},{"product":"tanstack\\/vue-start","vendor":"tanstack"},{"product":"tanstack\\/vue-start-client","vendor":"tanstack"},{"product":"tanstack\\/vue-start-server","vendor":"tanstack"},{"product":"tanstack\\/zod-adapter","vendor":"tanstack"},{"product":"uipath\\/access-policy-sdk","vendor":"uipath"},{"product":"uipath\\/access-policy-tool","vendor":"uipath"},{"product":"uipath\\/admin-tool","vendor":"uipath"},{"product":"uipath\\/agent-sdk","vendor":"uipath"},{"product":"uipath\\/agent-tool","vendor":"uipath"},{"product":"uipath\\/agent.sdk","vendor":"uipath"},{"product":"uipath\\/aops-policy-tool","vendor":"uipath"},{"product":"uipath\\/ap-chat","vendor":"uipath"},{"product":"uipath\\/api-workflow-tool","vendor":"uipath"},{"product":"uipath\\/apollo-core","vendor":"uipath"},{"product":"uipath\\/apollo-react","vendor":"uipath"},{"product":"uipath\\/apollo-wind","vendor":"uipath"},{"product":"uipath\\/auth","vendor":"uipath"},{"product":"uipath\\/case-tool","vendor":"uipath"},{"product":"uipath\\/cli","vendor":"uipath"},{"product":"uipath\\/codedagent-tool","vendor":"uipath"},{"product":"uipath\\/codedagents-tool","vendor":"uipath"},{"product":"uipath\\/codedapp-tool","vendor":"uipath"},{"product":"uipath\\/common","vendor":"uipath"},{"product":"uipath\\/context-grounding-tool","vendor":"uipath"},{"product":"uipath\\/data-fabric-tool","vendor":"uipath"},{"product":"uipath\\/docsai-tool","vendor":"uipath"},{"product":"uipath\\/filesystem","vendor":"uipath"},{"product":"uipath\\/flow-tool","vendor":"uipath"},{"product":"uipath\\/functions-tool","vendor":"uipath"},{"product":"uipath\\/gov-tool","vendor":"uipath"},{"product":"uipath\\/identity-tool","vendor":"uipath"},{"product":"uipath\\/insights-sdk","vendor":"uipath"},{"product":"uipath\\/insights-tool","vendor":"uipath"},{"product":"uipath\\/integrationservice-sdk","vendor":"uipath"},{"product":"uipath\\/integrationservice-tool","vendor":"uipath"},{"product":"uipath\\/llmgw-tool","vendor":"uipath"},{"product":"uipath\\/maestro-sdk","vendor":"uipath"},{"product":"uipath\\/maestro-tool","vendor":"uipath"},{"product":"uipath\\/orchestrator-tool","vendor":"uipath"},{"product":"uipath\\/packager-tool-apiworkflow","vendor":"uipath"},{"product":"uipath\\/packager-tool-bpmn","vendor":"uipath"},{"product":"uipath\\/packager-tool-case","vendor":"uipath"},{"product":"uipath\\/packager-tool-connector","vendor":"uipath"},{"product":"uipath\\/packager-tool-flow","vendor":"uipath"},{"product":"uipath\\/packager-tool-functions","vendor":"uipath"},{"product":"uipath\\/packager-tool-webapp","vendor":"uipath"},{"product":"uipath\\/packager-tool-workflowcompiler","vendor":"uipath"},{"product":"uipath\\/packager-tool-workflowcompiler-browser","vendor":"uipath"},{"product":"uipath\\/platform-tool","vendor":"uipath"},{"product":"uipath\\/project-packager","vendor":"uipath"},{"product":"uipath\\/resource-tool","vendor":"uipath"},{"product":"uipath\\/resourcecatalog-tool","vendor":"uipath"},{"product":"uipath\\/resources-tool","vendor":"uipath"},{"product":"uipath\\/robot","vendor":"uipath"},{"product":"uipath\\/rpa-legacy-tool","vendor":"uipath"},{"product":"uipath\\/rpa-tool","vendor":"uipath"},{"product":"uipath\\/solution-packager","vendor":"uipath"},{"product":"uipath\\/solution-tool","vendor":"uipath"},{"product":"uipath\\/solutionpackager-sdk","vendor":"uipath"},{"product":"uipath\\/solutionpackager-tool-core","vendor":"uipath"},{"product":"uipath\\/tasks-tool","vendor":"uipath"},{"product":"uipath\\/telemetry","vendor":"uipath"},{"product":"uipath\\/test-manager-tool","vendor":"uipath"},{"product":"uipath\\/tool-workflowcompiler","vendor":"uipath"},{"product":"uipath\\/traces-tool","vendor":"uipath"},{"product":"uipath\\/ui-widgets-multi-file-upload","vendor":"uipath"},{"product":"uipath\\/uipath-python-bridge","vendor":"uipath"},{"product":"uipath\\/vertical-solutions-tool","vendor":"uipath"},{"product":"uipath\\/vss","vendor":"uipath"},{"product":"uipath\\/widget.sdk","vendor":"uipath"}],"cvss":{"score":9.6,"severity":"critical","source":"cna","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","version":"3.1"},"cwes":[{"id":"CWE-506","name":"Embedded Malicious Code"}],"description":"On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for TanStack/router, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes — a pull_request_target \"Pwn Request\" misconfiguration, GitHub Actions cache poisoning across the fork↔base trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process — to publish credential-stealing malware under a trusted identity. Each affected package received exactly two malicious versions, published a few minutes apart.","ecosystems":["npm"],"exploits":{"exploitdb":0,"first_seen":"2026-05-12","github_poc":12,"max_poc_stars":3,"metasploit":0,"nuclei":0,"refs":[{"date":"2026-05-13T11:12:50Z","kind":"github_poc","ref":"https://github.com/Intrudify/mini-shai-hulud-scanner","stars":3,"title":"Scanner for the Mini Shai-Hulud npm/PyPI supply chain worm (NHS CC-4781 · CVE-2026-45321). Detects gh-token-monitor persistence, payload artefacts, and attacker commits. Python, Bash, PowerShell."},{"date":"2026-05-16T08:01:40Z","kind":"github_poc","ref":"https://github.com/fabriziosalmi/tanstack-compromise-checker","stars":2,"title":"Shell script to detect TanStack npm supply chain attack indicators (CVE-2026-45321 / GHSA-g7cv-rxg3-hmpx)"},{"date":"2026-05-12T20:18:18Z","kind":"github_poc","ref":"https://github.com/qi-scape/scan-shai-hulud","stars":1,"title":"Detect CVE-2026-45321 Mini Shai-Hulud supply chain compromise — scans for 170 npm + 2 PyPI poisoned packages across TanStack, Mistral AI, UiPath, OpenSearch, Guardrails AI"},{"date":"2026-05-12T23:54:59Z","kind":"github_poc","ref":"https://github.com/shayr1/shai-hulud-scan","stars":1,"title":"Claude Code skill to scan machines for Mini Shai-Hulud (CVE-2026-45321) supply chain worm IOCs"},{"date":"2026-05-18T09:16:47Z","kind":"github_poc","ref":"https://github.com/nkopylov/tanscript-exploit-check","stars":1,"title":"IOC checker for the TanStack/Mini Shai-Hulud npm supply chain attack (CVE-2026-45321)"},{"date":"2026-05-12T09:11:30Z","kind":"github_poc","ref":"https://github.com/ry-allan/tanstack-compromise-checker","stars":0,"title":"Detects CVE-2026-45321 (TanStack supply chain compromise) and Mini Shai-Hulud worm artifacts. Scans node_modules, lockfiles, persistence hooks (Claude Code, VS Code, systemd, LaunchAgent), GitHub workflows, git history, C2 domains, and AI tool configs."},{"date":"2026-05-12T13:08:36Z","kind":"github_poc","ref":"https://github.com/Yomisana/are-you-get-tanstack-attack","stars":0,"title":"Are you get Tanstack Supply chain attack attack of 5/11? CVE-2026-45321 / GHSA-g7cv-rxg3-hmpx"},{"date":"2026-05-12T19:58:56Z","kind":"github_poc","ref":"https://github.com/Caixa-git/tanstack-shield","stars":0,"title":"🛡️ One-command scanner for CVE-2026-45321 — TanStack npm supply-chain attack"}],"tier":"exploited"},"has_fix":true,"headline":"TanStack Unspecified","id":"CVE-2026-45321","indexable":true,"kev":{"dateAdded":"2026-05-27","dueDate":"2026-06-10","knownRansomwareCampaignUse":"Known","product":"TanStack","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","vendorProject":"TanStack","vulnerabilityName":"TanStack Unspecified Vulnerability"},"kind":"cve","links":{"ecosystem":"npm","product":null,"products":[],"type":"supply_chain","year":"2026"},"n_packages":168,"n_references":4,"next":{"headline":"OS Command Injection in Microsoft UFO Shell Action Replay via Stored Session JSON","id":"CVE-2026-45322"},"packages":[{"ecosystem":"npm","fixed":["1.166.16"],"introduced":["1.166.12"],"last_affected":[],"package":"@tanstack/arktype-adapter","purl":null,"source":"GHSA-g7cv-rxg3-hmpx"},{"ecosystem":"npm","fixed":["1.166.16"],"introduced":["1.166.12"],"last_affected":[],"package":"@tanstack/arktype-adapter","purl":"pkg:npm/%40tanstack/arktype-adapter","source":"GHSA-g7cv-rxg3-hmpx"},{"ecosystem":"npm","fixed":["1.166.16"],"introduced":["1.166.15"],"last_affected":[],"package":"@tanstack/arktype-adapter","purl":null,"source":"GHSA-g7cv-rxg3-hmpx"},{"ecosystem":"npm","fixed":["1.166.16"],"introduced":["1.166.15"],"last_affected":[],"package":"@tanstack/arktype-adapter","purl":"pkg:npm/%40tanstack/arktype-adapter","source":"GHSA-g7cv-rxg3-hmpx"},{"ecosystem":"npm","fixed":["1.161.13"],"introduced":["1.161.12"],"last_affected":[],"package":"@tanstack/eslint-plugin-router","purl":null,"source":"GHSA-g7cv-rxg3-hmpx"},{"ecosystem":"npm","fixed":["1.161.13"],"introduced":["1.161.12"],"last_affected":[],"package":"@tanstack/eslint-plugin-router","purl":"pkg:npm/%40tanstack/eslint-plugin-router","source":"GHSA-g7cv-rxg3-hmpx"},{"ecosystem":"npm","fixed":["1.161.13"],"introduced":["1.161.9"],"last_affected":[],"package":"@tanstack/eslint-plugin-router","purl":null,"source":"GHSA-g7cv-rxg3-hmpx"},{"ecosystem":"npm","fixed":["1.161.13"],"introduced":["1.161.9"],"last_affected":[],"package":"@tanstack/eslint-plugin-router","purl":"pkg:npm/%40tanstack/eslint-plugin-router","source":"GHSA-g7cv-rxg3-hmpx"},{"ecosystem":"npm","fixed":["0.0.8"],"introduced":["0.0.4"],"last_affected":[],"package":"@tanstack/eslint-plugin-start","purl":null,"source":"GHSA-g7cv-rxg3-hmpx"},{"ecosystem":"npm","fixed":["0.0.8"],"introduced":["0.0.4"],"last_affected":[],"package":"@tanstack/eslint-plugin-start","purl":"pkg:npm/%40tanstack/eslint-plugin-start","source":"GHSA-g7cv-rxg3-hmpx"},{"ecosystem":"npm","fixed":["0.0.8"],"introduced":["0.0.7"],"last_affected":[],"package":"@tanstack/eslint-plugin-start","purl":null,"source":"GHSA-g7cv-rxg3-hmpx"},{"ecosystem":"npm","fixed":["0.0.8"],"introduced":["0.0.7"],"last_affected":[],"package":"@tanstack/eslint-plugin-start","purl":"pkg:npm/%40tanstack/eslint-plugin-start","source":"GHSA-g7cv-rxg3-hmpx"},{"ecosystem":"npm","fixed":["1.161.13"],"introduced":["1.161.12"],"last_affected":[],"package":"@tanstack/history","purl":null,"source":"GHSA-g7cv-rxg3-hmpx"},{"ecosystem":"npm","fixed":["1.161.13"],"introduced":["1.161.12"],"last_affected":[],"package":"@tanstack/history","purl":"pkg:npm/%40tanstack/history","source":"GHSA-g7cv-rxg3-hmpx"},{"ecosystem":"npm","fixed":["1.161.13"],"introduced":["1.161.9"],"last_affected":[],"package":"@tanstack/history","purl":null,"source":"GHSA-g7cv-rxg3-hmpx"},{"ecosystem":"npm","fixed":["1.161.13"],"introduced":["1.161.9"],"last_affected":[],"package":"@tanstack/history","purl":"pkg:npm/%40tanstack/history","source":"GHSA-g7cv-rxg3-hmpx"},{"ecosystem":"npm","fixed":["1.154.16"],"introduced":["1.154.12"],"last_affected":[],"package":"@tanstack/nitro-v2-vite-plugin","purl":null,"source":"GHSA-g7cv-rxg3-hmpx"},{"ecosystem":"npm","fixed":["1.154.16"],"introduced":["1.154.12"],"last_affected":[],"package":"@tanstack/nitro-v2-vite-plugin","purl":"pkg:npm/%40tanstack/nitro-v2-vite-plugin","source":"GHSA-g7cv-rxg3-hmpx"},{"ecosystem":"npm","fixed":["1.154.16"],"introduced":["1.154.15"],"last_affected":[],"package":"@tanstack/nitro-v2-vite-plugin","purl":null,"source":"GHSA-g7cv-rxg3-hmpx"},{"ecosystem":"npm","fixed":["1.154.16"],"introduced":["1.154.15"],"last_affected":[],"package":"@tanstack/nitro-v2-vite-plugin","purl":"pkg:npm/%40tanstack/nitro-v2-vite-plugin","source":"GHSA-g7cv-rxg3-hmpx"},{"ecosystem":"npm","fixed":["1.169.9"],"introduced":["1.169.5"],"last_affected":[],"package":"@tanstack/react-router","purl":null,"source":"GHSA-g7cv-rxg3-hmpx"},{"ecosystem":"npm","fixed":["1.169.9"],"introduced":["1.169.5"],"last_affected":[],"package":"@tanstack/react-router","purl":"pkg:npm/%40tanstack/react-router","source":"GHSA-g7cv-rxg3-hmpx"},{"ecosystem":"npm","fixed":["1.169.9"],"introduced":["1.169.8"],"last_affected":[],"package":"@tanstack/react-router","purl":null,"source":"GHSA-g7cv-rxg3-hmpx"},{"ecosystem":"npm","fixed":["1.169.9"],"introduced":["1.169.8"],"last_affected":[],"package":"@tanstack/react-router","purl":"pkg:npm/%40tanstack/react-router","source":"GHSA-g7cv-rxg3-hmpx"},{"ecosystem":"npm","fixed":["1.166.20"],"introduced":["1.166.16"],"last_affected":[],"package":"@tanstack/react-router-devtools","purl":null,"source":"GHSA-g7cv-rxg3-hmpx"},{"ecosystem":"npm","fixed":["1.166.20"],"introduced":["1.166.16"],"last_affected":[],"package":"@tanstack/react-router-devtools","purl":"pkg:npm/%40tanstack/react-router-devtools","source":"GHSA-g7cv-rxg3-hmpx"},{"ecosystem":"npm","fixed":["1.166.20"],"introduced":["1.166.19"],"last_affected":[],"package":"@tanstack/react-router-devtools","purl":null,"source":"GHSA-g7cv-rxg3-hmpx"},{"ecosystem":"npm","fixed":["1.166.20"],"introduced":["1.166.19"],"last_affected":[],"package":"@tanstack/react-router-devtools","purl":"pkg:npm/%40tanstack/react-router-devtools","source":"GHSA-g7cv-rxg3-hmpx"},{"ecosystem":"npm","fixed":["1.166.19"],"introduced":["1.166.15"],"last_affected":[],"package":"@tanstack/react-router-ssr-query","purl":null,"source":"GHSA-g7cv-rxg3-hmpx"},{"ecosystem":"npm","fixed":["1.166.19"],"introduced":["1.166.15"],"last_affected":[],"package":"@tanstack/react-router-ssr-query","purl":"pkg:npm/%40tanstack/react-router-ssr-query","source":"GHSA-g7cv-rxg3-hmpx"},{"ecosystem":"npm","fixed":["1.166.19"],"introduced":["1.166.18"],"last_affected":[],"package":"@tanstack/react-router-ssr-query","purl":null,"source":"GHSA-g7cv-rxg3-hmpx"},{"ecosystem":"npm","fixed":["1.166.19"],"introduced":["1.166.18"],"last_affected":[],"package":"@tanstack/react-router-ssr-query","purl":"pkg:npm/%40tanstack/react-router-ssr-query","source":"GHSA-g7cv-rxg3-hmpx"},{"ecosystem":"npm","fixed":["1.167.72"],"introduced":["1.167.68"],"last_affected":[],"package":"@tanstack/react-start","purl":null,"source":"GHSA-g7cv-rxg3-hmpx"},{"ecosystem":"npm","fixed":["1.167.72"],"introduced":["1.167.68"],"last_affected":[],"package":"@tanstack/react-start","purl":"pkg:npm/%40tanstack/react-start","source":"GHSA-g7cv-rxg3-hmpx"},{"ecosystem":"npm","fixed":["1.167.72"],"introduced":["1.167.71"],"last_affected":[],"package":"@tanstack/react-start","purl":null,"source":"GHSA-g7cv-rxg3-hmpx"},{"ecosystem":"npm","fixed":["1.167.72"],"introduced":["1.167.71"],"last_affected":[],"package":"@tanstack/react-start","purl":"pkg:npm/%40tanstack/react-start","source":"GHSA-g7cv-rxg3-hmpx"},{"ecosystem":"npm","fixed":["1.166.55"],"introduced":["1.166.51"],"last_affected":[],"package":"@tanstack/react-start-client","purl":null,"source":"GHSA-g7cv-rxg3-hmpx"},{"ecosystem":"npm","fixed":["1.166.55"],"introduced":["1.166.51"],"last_affected":[],"package":"@tanstack/react-start-client","purl":"pkg:npm/%40tanstack/react-start-client","source":"GHSA-g7cv-rxg3-hmpx"},{"ecosystem":"npm","fixed":["1.166.55"],"introduced":["1.166.54"],"last_affected":[],"package":"@tanstack/react-start-client","purl":null,"source":"GHSA-g7cv-rxg3-hmpx"},{"ecosystem":"npm","fixed":["1.166.55"],"introduced":["1.166.54"],"last_affected":[],"package":"@tanstack/react-start-client","purl":"pkg:npm/%40tanstack/react-start-client","source":"GHSA-g7cv-rxg3-hmpx"}],"prev":{"headline":"DataEase Data Dashboard SqlVariable transFilter Unfiltered SQL Injection","id":"CVE-2026-45320"},"products":["arktype-adapter","eslint-plugin-router","eslint-plugin-start","history","nitro-v2-vite-plugin","outer-vite-plugin","react-router","react-router-devtools","react-router-ssr-query","react-start","react-start-client","react-start-rsc","react-start-server","router-cli","router-core","router-devtools","router-devtools-core","router-generator","router-plugin","router-ssr-query-core","router-utils","solid-router","solid-router-devtools","solid-router-ssr-query","solid-start","solid-start-client","solid-start-server","start-client-core","start-fn-stubs","start-plugin-core","start-server-core","start-static-server-functions","start-storage-context","valibot-adapter","virtual-file-routes","vue-router","vue-router-devtools","vue-router-ssr-query","vue-start","vue-start-client","vue-start-server","zod-adapter"],"published":"2026-05-12","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"open","licence":"CC0 1.0","name":"CISA KEV"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"},{"class":"open","licence":"CC0","name":"PoC-in-GitHub"}],"ssvc":{"automatable":"no","exploitation":"active","technical_impact":"total"},"state":"PUBLISHED","updated":"2026-08-04","vendors":["@tanstack"]},"summary":"Attackers published malicious versions of TanStack npm packages to steal cloud credentials, GitHub tokens, and SSH keys from users installing them.","url":"https://insights.sbomify.com/CVE-2026-45321/"}