CVE-2026-102989

{
  "etk_id": "ETK-2026-261",
  "cve_id": "CVE-2026-102989",
  "display_id": "CVE-2026-102989",
  "ghsa_id": "GHSA-qx66-fv34-fjm8",
  "euvd_id": "EUVD-2026-98849",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Cross-site scripting in TanStack Start server functions",
  "summary": "Affected TanStack Start server-function packages can return attacker-controlled HTML from an application's origin. An unauthenticated attacker can target a server-function URL; exploitation requires a victim to open the crafted link, after which script may access same-origin data and act with that visitor's permissions.",
  "mitigation": "Upgrade @tanstack/start-server-core to 1.169.39, @tanstack/react-start to 1.168.60, @tanstack/solid-start to 1.168.57, or @tanstack/vue-start to 1.168.56, as applicable. Until upgraded, restrict requests to configured server-function paths with tested edge or WAF rules and apply a restrictive CSP to server-function responses.",
  "vendor": "npm",
  "product": "npm:@tanstack/start-server-core",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 1.143.12, < 1.169.39"
      ],
      "ecosystem": "npm",
      "fixed_versions": [
        "1.169.39"
      ],
      "package_name": "@tanstack/start-server-core",
      "purl": "pkg:npm/@tanstack/start-server-core"
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 1.143.12, < 1.168.60"
      ],
      "ecosystem": "npm",
      "fixed_versions": [
        "1.168.60"
      ],
      "package_name": "@tanstack/react-start",
      "purl": "pkg:npm/@tanstack/react-start"
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 1.143.12, < 1.168.57"
      ],
      "ecosystem": "npm",
      "fixed_versions": [
        "1.168.57"
      ],
      "package_name": "@tanstack/solid-start",
      "purl": "pkg:npm/@tanstack/solid-start"
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 1.143.12, < 1.168.56"
      ],
      "ecosystem": "npm",
      "fixed_versions": [
        "1.168.56"
      ],
      "package_name": "@tanstack/vue-start",
      "purl": "pkg:npm/@tanstack/vue-start"
    }
  ],
  "cwes": [
    79
  ],
  "cvss_score": 9.3,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N",
  "epss_score": 0.0052,
  "epss_percentile": 0.4276,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": true,
  "check_confidence_basis": "mechanism_verified",
  "exploit": false,
  "pipeline_minutes": 21.752354033333333,
  "t0_at": "2026-10-13T16:13:13.105000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-01T17:44:35.255263+00:00",
      "days": -11.936549186770833,
      "is_lower_bound": false,
      "measured_at": "2026-10-13T16:13:13.105000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-09-30T17:57:08+00:00",
      "days": -12.927836863425926,
      "is_lower_bound": false,
      "measured_at": "2026-10-13T16:13:13.105000+00:00",
      "url": "https://github.com/TanStack/router/security/advisories/GHSA-qx66-fv34-fjm8"
    }
  }
}