CVE Explorer

CVE-2026-45321

On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for TanStack/router, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes — a pull_request_target "Pwn Request" misconfiguration, GitHub Actions cache poisoning across the fork↔base trust boundary, and r

Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:e732112828f12daf62f20bc3f8b937024521f80d13de6d58260336a6f6100e69

Known exploited

CISA KEV

Disputed

Stale source

Conflicts

Preserved source conflicts

No provider value was silently selected as the winner.

affected · 42 assertions

{"product":"solid-start-client","vendor":"@tanstack","versions":[{"status":"affected","version":"1.166.50"},{"status":"affected","version":"1.166.53"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:b9b2227464c5cdea55d0368438cc09846f46a4d8a57eb5c9cca6205f1cb6db17 · sha256:0e709a4806fb1c58… · /containers/cna/affected/25

{"product":"router-devtools","vendor":"@tanstack","versions":[{"status":"affected","version":"1.166.16"},{"status":"affected","version":"1.166.19"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:b9b2227464c5cdea55d0368438cc09846f46a4d8a57eb5c9cca6205f1cb6db17 · sha256:0e709a4806fb1c58… · /containers/cna/affected/14

{"product":"router-devtools-core","vendor":"@tanstack","versions":[{"status":"affected","version":"1.167.6"},{"status":"affected","version":"1.167.9"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:b9b2227464c5cdea55d0368438cc09846f46a4d8a57eb5c9cca6205f1cb6db17 · sha256:0e709a4806fb1c58… · /containers/cna/affected/15

{"product":"solid-router","vendor":"@tanstack","versions":[{"status":"affected","version":"1.169.5"},{"status":"affected","version":"1.169.8"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:b9b2227464c5cdea55d0368438cc09846f46a4d8a57eb5c9cca6205f1cb6db17 · sha256:0e709a4806fb1c58… · /containers/cna/affected/21

{"product":"vue-start","vendor":"@tanstack","versions":[{"status":"affected","version":"1.167.61"},{"status":"affected","version":"1.167.64"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:b9b2227464c5cdea55d0368438cc09846f46a4d8a57eb5c9cca6205f1cb6db17 · sha256:0e709a4806fb1c58… · /containers/cna/affected/38

{"product":"outer-vite-plugin","vendor":"@tanstack","versions":[{"status":"affected","version":"1.166.53"},{"status":"affected","version":"1.166.56"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:b9b2227464c5cdea55d0368438cc09846f46a4d8a57eb5c9cca6205f1cb6db17 · sha256:0e709a4806fb1c58… · /containers/cna/affected/20

{"product":"react-router","vendor":"@tanstack","versions":[{"status":"affected","version":"1.169.5"},{"status":"affected","version":"1.169.8"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:b9b2227464c5cdea55d0368438cc09846f46a4d8a57eb5c9cca6205f1cb6db17 · sha256:0e709a4806fb1c58… · /containers/cna/affected/5

{"product":"vue-router-devtools","vendor":"@tanstack","versions":[{"status":"affected","version":"1.166.16"},{"status":"affected","version":"1.166.19"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:b9b2227464c5cdea55d0368438cc09846f46a4d8a57eb5c9cca6205f1cb6db17 · sha256:0e709a4806fb1c58… · /containers/cna/affected/36

{"product":"react-router-devtools","vendor":"@tanstack","versions":[{"status":"affected","version":"1.166.16"},{"status":"affected","version":"1.166.19"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:b9b2227464c5cdea55d0368438cc09846f46a4d8a57eb5c9cca6205f1cb6db17 · sha256:0e709a4806fb1c58… · /containers/cna/affected/6

{"product":"solid-router-ssr-query","vendor":"@tanstack","versions":[{"status":"affected","version":"1.166.15"},{"status":"affected","version":"1.166.18"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:b9b2227464c5cdea55d0368438cc09846f46a4d8a57eb5c9cca6205f1cb6db17 · sha256:0e709a4806fb1c58… · /containers/cna/affected/23

{"product":"router-utils","vendor":"@tanstack","versions":[{"status":"affected","version":"1.161.11"},{"status":"affected","version":"1.161.14"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:b9b2227464c5cdea55d0368438cc09846f46a4d8a57eb5c9cca6205f1cb6db17 · sha256:0e709a4806fb1c58… · /containers/cna/affected/19

{"product":"react-router-ssr-query","vendor":"@tanstack","versions":[{"status":"affected","version":"1.166.15"},{"status":"affected","version":"1.166.18"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:b9b2227464c5cdea55d0368438cc09846f46a4d8a57eb5c9cca6205f1cb6db17 · sha256:0e709a4806fb1c58… · /containers/cna/affected/7

{"product":"react-start-server","vendor":"@tanstack","versions":[{"status":"affected","version":"1.166.55"},{"status":"affected","version":"1.166.58"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:b9b2227464c5cdea55d0368438cc09846f46a4d8a57eb5c9cca6205f1cb6db17 · sha256:0e709a4806fb1c58… · /containers/cna/affected/11

{"product":"arktype-adapter","vendor":"@tanstack","versions":[{"status":"affected","version":"1.166.12"},{"status":"affected","version":"1.166.15"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:b9b2227464c5cdea55d0368438cc09846f46a4d8a57eb5c9cca6205f1cb6db17 · sha256:0e709a4806fb1c58… · /containers/cna/affected/0

{"product":"vue-router","vendor":"@tanstack","versions":[{"status":"affected","version":"1.169.5"},{"status":"affected","version":"1.169.8"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:b9b2227464c5cdea55d0368438cc09846f46a4d8a57eb5c9cca6205f1cb6db17 · sha256:0e709a4806fb1c58… · /containers/cna/affected/35

{"product":"virtual-file-routes","vendor":"@tanstack","versions":[{"status":"affected","version":"1.161.10"},{"status":"affected","version":"1.161.13"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:b9b2227464c5cdea55d0368438cc09846f46a4d8a57eb5c9cca6205f1cb6db17 · sha256:0e709a4806fb1c58… · /containers/cna/affected/34

{"product":"valibot-adapter","vendor":"@tanstack","versions":[{"status":"affected","version":"1.166.12"},{"status":"affected","version":"1.166.15"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:b9b2227464c5cdea55d0368438cc09846f46a4d8a57eb5c9cca6205f1cb6db17 · sha256:0e709a4806fb1c58… · /containers/cna/affected/33

{"product":"router-plugin","vendor":"@tanstack","versions":[{"status":"affected","version":"1.167.38"},{"status":"affected","version":"1.167.41"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:b9b2227464c5cdea55d0368438cc09846f46a4d8a57eb5c9cca6205f1cb6db17 · sha256:0e709a4806fb1c58… · /containers/cna/affected/17

{"product":"eslint-plugin-start","vendor":"@tanstack","versions":[{"status":"affected","version":"0.0.4"},{"status":"affected","version":"0.0.7"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:b9b2227464c5cdea55d0368438cc09846f46a4d8a57eb5c9cca6205f1cb6db17 · sha256:0e709a4806fb1c58… · /containers/cna/affected/2

{"product":"router-core","vendor":"@tanstack","versions":[{"status":"affected","version":"1.169.5"},{"status":"affected","version":"1.169.8"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:b9b2227464c5cdea55d0368438cc09846f46a4d8a57eb5c9cca6205f1cb6db17 · sha256:0e709a4806fb1c58… · /containers/cna/affected/13

{"product":"solid-router-devtools","vendor":"@tanstack","versions":[{"status":"affected","version":"1.166.16"},{"status":"affected","version":"1.166.19"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:b9b2227464c5cdea55d0368438cc09846f46a4d8a57eb5c9cca6205f1cb6db17 · sha256:0e709a4806fb1c58… · /containers/cna/affected/22

{"product":"react-start-client","vendor":"@tanstack","versions":[{"status":"affected","version":"1.166.51"},{"status":"affected","version":"1.166.54"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:b9b2227464c5cdea55d0368438cc09846f46a4d8a57eb5c9cca6205f1cb6db17 · sha256:0e709a4806fb1c58… · /containers/cna/affected/9

{"product":"react-start-rsc","vendor":"@tanstack","versions":[{"status":"affected","version":"0.0.47"},{"status":"affected","version":"0.0.50"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:b9b2227464c5cdea55d0368438cc09846f46a4d8a57eb5c9cca6205f1cb6db17 · sha256:0e709a4806fb1c58… · /containers/cna/affected/10

{"product":"eslint-plugin-router","vendor":"@tanstack","versions":[{"status":"affected","version":"1.161.9"},{"status":"affected","version":"1.161.12"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:b9b2227464c5cdea55d0368438cc09846f46a4d8a57eb5c9cca6205f1cb6db17 · sha256:0e709a4806fb1c58… · /containers/cna/affected/1

{"product":"solid-start-server","vendor":"@tanstack","versions":[{"status":"affected","version":"1.166.54"},{"status":"affected","version":"1.166.57"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:b9b2227464c5cdea55d0368438cc09846f46a4d8a57eb5c9cca6205f1cb6db17 · sha256:0e709a4806fb1c58… · /containers/cna/affected/26

{"product":"start-server-core","vendor":"@tanstack","versions":[{"status":"affected","version":"1.167.33"},{"status":"affected","version":"1.167.36"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:b9b2227464c5cdea55d0368438cc09846f46a4d8a57eb5c9cca6205f1cb6db17 · sha256:0e709a4806fb1c58… · /containers/cna/affected/30

{"product":"vue-start-server","vendor":"@tanstack","versions":[{"status":"affected","version":"1.166.50"},{"status":"affected","version":"1.166.53"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:b9b2227464c5cdea55d0368438cc09846f46a4d8a57eb5c9cca6205f1cb6db17 · sha256:0e709a4806fb1c58… · /containers/cna/affected/40

{"product":"solid-start","vendor":"@tanstack","versions":[{"status":"affected","version":"1.167.65"},{"status":"affected","version":"1.167.68"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:b9b2227464c5cdea55d0368438cc09846f46a4d8a57eb5c9cca6205f1cb6db17 · sha256:0e709a4806fb1c58… · /containers/cna/affected/24

{"product":"start-storage-context","vendor":"@tanstack","versions":[{"status":"affected","version":"1.166.38"},{"status":"affected","version":"1.166.41"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:b9b2227464c5cdea55d0368438cc09846f46a4d8a57eb5c9cca6205f1cb6db17 · sha256:0e709a4806fb1c58… · /containers/cna/affected/32

{"product":"start-plugin-core","vendor":"@tanstack","versions":[{"status":"affected","version":"1.169.23"},{"status":"affected","version":"1.169.26"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:b9b2227464c5cdea55d0368438cc09846f46a4d8a57eb5c9cca6205f1cb6db17 · sha256:0e709a4806fb1c58… · /containers/cna/affected/29

{"product":"start-static-server-functions","vendor":"@tanstack","versions":[{"status":"affected","version":"1.166.44"},{"status":"affected","version":"1.166.47"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:b9b2227464c5cdea55d0368438cc09846f46a4d8a57eb5c9cca6205f1cb6db17 · sha256:0e709a4806fb1c58… · /containers/cna/affected/31

{"product":"nitro-v2-vite-plugin","vendor":"@tanstack","versions":[{"status":"affected","version":"1.154.12"},{"status":"affected","version":"1.154.15"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:b9b2227464c5cdea55d0368438cc09846f46a4d8a57eb5c9cca6205f1cb6db17 · sha256:0e709a4806fb1c58… · /containers/cna/affected/4

{"product":"react-start","vendor":"@tanstack","versions":[{"status":"affected","version":"1.167.68"},{"status":"affected","version":"1.167.71"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:b9b2227464c5cdea55d0368438cc09846f46a4d8a57eb5c9cca6205f1cb6db17 · sha256:0e709a4806fb1c58… · /containers/cna/affected/8

{"product":"history","vendor":"@tanstack","versions":[{"status":"affected","version":"1.161.9"},{"status":"affected","version":"1.161.12"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:b9b2227464c5cdea55d0368438cc09846f46a4d8a57eb5c9cca6205f1cb6db17 · sha256:0e709a4806fb1c58… · /containers/cna/affected/3

{"product":"router-generator","vendor":"@tanstack","versions":[{"status":"affected","version":"1.166.45"},{"status":"affected","version":"1.166.48"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:b9b2227464c5cdea55d0368438cc09846f46a4d8a57eb5c9cca6205f1cb6db17 · sha256:0e709a4806fb1c58… · /containers/cna/affected/16

{"product":"router-ssr-query-core","vendor":"@tanstack","versions":[{"status":"affected","version":"1.168.3"},{"status":"affected","version":"1.168.6"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:b9b2227464c5cdea55d0368438cc09846f46a4d8a57eb5c9cca6205f1cb6db17 · sha256:0e709a4806fb1c58… · /containers/cna/affected/18

{"product":"start-client-core","vendor":"@tanstack","versions":[{"status":"affected","version":"1.168.5"},{"status":"affected","version":"1.168.8"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:b9b2227464c5cdea55d0368438cc09846f46a4d8a57eb5c9cca6205f1cb6db17 · sha256:0e709a4806fb1c58… · /containers/cna/affected/27

{"product":"vue-router-ssr-query","vendor":"@tanstack","versions":[{"status":"affected","version":"1.166.15"},{"status":"affected","version":"1.166.18"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:b9b2227464c5cdea55d0368438cc09846f46a4d8a57eb5c9cca6205f1cb6db17 · sha256:0e709a4806fb1c58… · /containers/cna/affected/37

{"product":"router-cli","vendor":"@tanstack","versions":[{"status":"affected","version":"1.166.46"},{"status":"affected","version":"1.166.49"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:b9b2227464c5cdea55d0368438cc09846f46a4d8a57eb5c9cca6205f1cb6db17 · sha256:0e709a4806fb1c58… · /containers/cna/affected/12

{"product":"zod-adapter","vendor":"@tanstack","versions":[{"status":"affected","version":"1.166.12"},{"status":"affected","version":"1.166.15"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:b9b2227464c5cdea55d0368438cc09846f46a4d8a57eb5c9cca6205f1cb6db17 · sha256:0e709a4806fb1c58… · /containers/cna/affected/41

{"product":"start-fn-stubs","vendor":"@tanstack","versions":[{"status":"affected","version":"1.161.9"},{"status":"affected","version":"1.161.12"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:b9b2227464c5cdea55d0368438cc09846f46a4d8a57eb5c9cca6205f1cb6db17 · sha256:0e709a4806fb1c58… · /containers/cna/affected/28

{"product":"vue-start-client","vendor":"@tanstack","versions":[{"status":"affected","version":"1.166.46"},{"status":"affected","version":"1.166.49"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:b9b2227464c5cdea55d0368438cc09846f46a4d8a57eb5c9cca6205f1cb6db17 · sha256:0e709a4806fb1c58… · /containers/cna/affected/39

Affected products and versions

42 source assertions

{"product":"solid-start-client","vendor":"@tanstack","versions":[{"status":"affected","version":"1.166.50"},{"status":"affected","version":"1.166.53"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:b9b2227464c5cdea55d0368438cc09846f46a4d8a57eb5c9cca6205f1cb6db17 · sha256:0e709a4806fb1c58… · /containers/cna/affected/25

{"product":"router-devtools","vendor":"@tanstack","versions":[{"status":"affected","version":"1.166.16"},{"status":"affected","version":"1.166.19"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:b9b2227464c5cdea55d0368438cc09846f46a4d8a57eb5c9cca6205f1cb6db17 · sha256:0e709a4806fb1c58… · /containers/cna/affected/14

{"product":"router-devtools-core","vendor":"@tanstack","versions":[{"status":"affected","version":"1.167.6"},{"status":"affected","version":"1.167.9"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:b9b2227464c5cdea55d0368438cc09846f46a4d8a57eb5c9cca6205f1cb6db17 · sha256:0e709a4806fb1c58… · /containers/cna/affected/15

{"product":"solid-router","vendor":"@tanstack","versions":[{"status":"affected","version":"1.169.5"},{"status":"affected","version":"1.169.8"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:b9b2227464c5cdea55d0368438cc09846f46a4d8a57eb5c9cca6205f1cb6db17 · sha256:0e709a4806fb1c58… · /containers/cna/affected/21

{"product":"vue-start","vendor":"@tanstack","versions":[{"status":"affected","version":"1.167.61"},{"status":"affected","version":"1.167.64"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:b9b2227464c5cdea55d0368438cc09846f46a4d8a57eb5c9cca6205f1cb6db17 · sha256:0e709a4806fb1c58… · /containers/cna/affected/38

{"product":"outer-vite-plugin","vendor":"@tanstack","versions":[{"status":"affected","version":"1.166.53"},{"status":"affected","version":"1.166.56"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:b9b2227464c5cdea55d0368438cc09846f46a4d8a57eb5c9cca6205f1cb6db17 · sha256:0e709a4806fb1c58… · /containers/cna/affected/20

{"product":"react-router","vendor":"@tanstack","versions":[{"status":"affected","version":"1.169.5"},{"status":"affected","version":"1.169.8"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:b9b2227464c5cdea55d0368438cc09846f46a4d8a57eb5c9cca6205f1cb6db17 · sha256:0e709a4806fb1c58… · /containers/cna/affected/5

{"product":"vue-router-devtools","vendor":"@tanstack","versions":[{"status":"affected","version":"1.166.16"},{"status":"affected","version":"1.166.19"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:b9b2227464c5cdea55d0368438cc09846f46a4d8a57eb5c9cca6205f1cb6db17 · sha256:0e709a4806fb1c58… · /containers/cna/affected/36

{"product":"react-router-devtools","vendor":"@tanstack","versions":[{"status":"affected","version":"1.166.16"},{"status":"affected","version":"1.166.19"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:b9b2227464c5cdea55d0368438cc09846f46a4d8a57eb5c9cca6205f1cb6db17 · sha256:0e709a4806fb1c58… · /containers/cna/affected/6

{"product":"solid-router-ssr-query","vendor":"@tanstack","versions":[{"status":"affected","version":"1.166.15"},{"status":"affected","version":"1.166.18"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:b9b2227464c5cdea55d0368438cc09846f46a4d8a57eb5c9cca6205f1cb6db17 · sha256:0e709a4806fb1c58… · /containers/cna/affected/23

{"product":"router-utils","vendor":"@tanstack","versions":[{"status":"affected","version":"1.161.11"},{"status":"affected","version":"1.161.14"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:b9b2227464c5cdea55d0368438cc09846f46a4d8a57eb5c9cca6205f1cb6db17 · sha256:0e709a4806fb1c58… · /containers/cna/affected/19

{"product":"react-router-ssr-query","vendor":"@tanstack","versions":[{"status":"affected","version":"1.166.15"},{"status":"affected","version":"1.166.18"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:b9b2227464c5cdea55d0368438cc09846f46a4d8a57eb5c9cca6205f1cb6db17 · sha256:0e709a4806fb1c58… · /containers/cna/affected/7

{"product":"react-start-server","vendor":"@tanstack","versions":[{"status":"affected","version":"1.166.55"},{"status":"affected","version":"1.166.58"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:b9b2227464c5cdea55d0368438cc09846f46a4d8a57eb5c9cca6205f1cb6db17 · sha256:0e709a4806fb1c58… · /containers/cna/affected/11

{"product":"arktype-adapter","vendor":"@tanstack","versions":[{"status":"affected","version":"1.166.12"},{"status":"affected","version":"1.166.15"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:b9b2227464c5cdea55d0368438cc09846f46a4d8a57eb5c9cca6205f1cb6db17 · sha256:0e709a4806fb1c58… · /containers/cna/affected/0

{"product":"vue-router","vendor":"@tanstack","versions":[{"status":"affected","version":"1.169.5"},{"status":"affected","version":"1.169.8"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:b9b2227464c5cdea55d0368438cc09846f46a4d8a57eb5c9cca6205f1cb6db17 · sha256:0e709a4806fb1c58… · /containers/cna/affected/35

{"product":"virtual-file-routes","vendor":"@tanstack","versions":[{"status":"affected","version":"1.161.10"},{"status":"affected","version":"1.161.13"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:b9b2227464c5cdea55d0368438cc09846f46a4d8a57eb5c9cca6205f1cb6db17 · sha256:0e709a4806fb1c58… · /containers/cna/affected/34

{"product":"valibot-adapter","vendor":"@tanstack","versions":[{"status":"affected","version":"1.166.12"},{"status":"affected","version":"1.166.15"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:b9b2227464c5cdea55d0368438cc09846f46a4d8a57eb5c9cca6205f1cb6db17 · sha256:0e709a4806fb1c58… · /containers/cna/affected/33

{"product":"router-plugin","vendor":"@tanstack","versions":[{"status":"affected","version":"1.167.38"},{"status":"affected","version":"1.167.41"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:b9b2227464c5cdea55d0368438cc09846f46a4d8a57eb5c9cca6205f1cb6db17 · sha256:0e709a4806fb1c58… · /containers/cna/affected/17

{"product":"eslint-plugin-start","vendor":"@tanstack","versions":[{"status":"affected","version":"0.0.4"},{"status":"affected","version":"0.0.7"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:b9b2227464c5cdea55d0368438cc09846f46a4d8a57eb5c9cca6205f1cb6db17 · sha256:0e709a4806fb1c58… · /containers/cna/affected/2

{"product":"router-core","vendor":"@tanstack","versions":[{"status":"affected","version":"1.169.5"},{"status":"affected","version":"1.169.8"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:b9b2227464c5cdea55d0368438cc09846f46a4d8a57eb5c9cca6205f1cb6db17 · sha256:0e709a4806fb1c58… · /containers/cna/affected/13

{"product":"solid-router-devtools","vendor":"@tanstack","versions":[{"status":"affected","version":"1.166.16"},{"status":"affected","version":"1.166.19"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:b9b2227464c5cdea55d0368438cc09846f46a4d8a57eb5c9cca6205f1cb6db17 · sha256:0e709a4806fb1c58… · /containers/cna/affected/22

{"product":"react-start-client","vendor":"@tanstack","versions":[{"status":"affected","version":"1.166.51"},{"status":"affected","version":"1.166.54"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:b9b2227464c5cdea55d0368438cc09846f46a4d8a57eb5c9cca6205f1cb6db17 · sha256:0e709a4806fb1c58… · /containers/cna/affected/9

{"product":"react-start-rsc","vendor":"@tanstack","versions":[{"status":"affected","version":"0.0.47"},{"status":"affected","version":"0.0.50"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:b9b2227464c5cdea55d0368438cc09846f46a4d8a57eb5c9cca6205f1cb6db17 · sha256:0e709a4806fb1c58… · /containers/cna/affected/10

{"product":"eslint-plugin-router","vendor":"@tanstack","versions":[{"status":"affected","version":"1.161.9"},{"status":"affected","version":"1.161.12"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:b9b2227464c5cdea55d0368438cc09846f46a4d8a57eb5c9cca6205f1cb6db17 · sha256:0e709a4806fb1c58… · /containers/cna/affected/1

{"product":"solid-start-server","vendor":"@tanstack","versions":[{"status":"affected","version":"1.166.54"},{"status":"affected","version":"1.166.57"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:b9b2227464c5cdea55d0368438cc09846f46a4d8a57eb5c9cca6205f1cb6db17 · sha256:0e709a4806fb1c58… · /containers/cna/affected/26

{"product":"start-server-core","vendor":"@tanstack","versions":[{"status":"affected","version":"1.167.33"},{"status":"affected","version":"1.167.36"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:b9b2227464c5cdea55d0368438cc09846f46a4d8a57eb5c9cca6205f1cb6db17 · sha256:0e709a4806fb1c58… · /containers/cna/affected/30

{"product":"vue-start-server","vendor":"@tanstack","versions":[{"status":"affected","version":"1.166.50"},{"status":"affected","version":"1.166.53"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:b9b2227464c5cdea55d0368438cc09846f46a4d8a57eb5c9cca6205f1cb6db17 · sha256:0e709a4806fb1c58… · /containers/cna/affected/40

{"product":"solid-start","vendor":"@tanstack","versions":[{"status":"affected","version":"1.167.65"},{"status":"affected","version":"1.167.68"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:b9b2227464c5cdea55d0368438cc09846f46a4d8a57eb5c9cca6205f1cb6db17 · sha256:0e709a4806fb1c58… · /containers/cna/affected/24

{"product":"start-storage-context","vendor":"@tanstack","versions":[{"status":"affected","version":"1.166.38"},{"status":"affected","version":"1.166.41"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:b9b2227464c5cdea55d0368438cc09846f46a4d8a57eb5c9cca6205f1cb6db17 · sha256:0e709a4806fb1c58… · /containers/cna/affected/32

{"product":"start-plugin-core","vendor":"@tanstack","versions":[{"status":"affected","version":"1.169.23"},{"status":"affected","version":"1.169.26"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:b9b2227464c5cdea55d0368438cc09846f46a4d8a57eb5c9cca6205f1cb6db17 · sha256:0e709a4806fb1c58… · /containers/cna/affected/29

{"product":"start-static-server-functions","vendor":"@tanstack","versions":[{"status":"affected","version":"1.166.44"},{"status":"affected","version":"1.166.47"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:b9b2227464c5cdea55d0368438cc09846f46a4d8a57eb5c9cca6205f1cb6db17 · sha256:0e709a4806fb1c58… · /containers/cna/affected/31

{"product":"nitro-v2-vite-plugin","vendor":"@tanstack","versions":[{"status":"affected","version":"1.154.12"},{"status":"affected","version":"1.154.15"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:b9b2227464c5cdea55d0368438cc09846f46a4d8a57eb5c9cca6205f1cb6db17 · sha256:0e709a4806fb1c58… · /containers/cna/affected/4

{"product":"react-start","vendor":"@tanstack","versions":[{"status":"affected","version":"1.167.68"},{"status":"affected","version":"1.167.71"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:b9b2227464c5cdea55d0368438cc09846f46a4d8a57eb5c9cca6205f1cb6db17 · sha256:0e709a4806fb1c58… · /containers/cna/affected/8

{"product":"history","vendor":"@tanstack","versions":[{"status":"affected","version":"1.161.9"},{"status":"affected","version":"1.161.12"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:b9b2227464c5cdea55d0368438cc09846f46a4d8a57eb5c9cca6205f1cb6db17 · sha256:0e709a4806fb1c58… · /containers/cna/affected/3

{"product":"router-generator","vendor":"@tanstack","versions":[{"status":"affected","version":"1.166.45"},{"status":"affected","version":"1.166.48"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:b9b2227464c5cdea55d0368438cc09846f46a4d8a57eb5c9cca6205f1cb6db17 · sha256:0e709a4806fb1c58… · /containers/cna/affected/16

{"product":"router-ssr-query-core","vendor":"@tanstack","versions":[{"status":"affected","version":"1.168.3"},{"status":"affected","version":"1.168.6"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:b9b2227464c5cdea55d0368438cc09846f46a4d8a57eb5c9cca6205f1cb6db17 · sha256:0e709a4806fb1c58… · /containers/cna/affected/18

{"product":"start-client-core","vendor":"@tanstack","versions":[{"status":"affected","version":"1.168.5"},{"status":"affected","version":"1.168.8"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:b9b2227464c5cdea55d0368438cc09846f46a4d8a57eb5c9cca6205f1cb6db17 · sha256:0e709a4806fb1c58… · /containers/cna/affected/27

{"product":"vue-router-ssr-query","vendor":"@tanstack","versions":[{"status":"affected","version":"1.166.15"},{"status":"affected","version":"1.166.18"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:b9b2227464c5cdea55d0368438cc09846f46a4d8a57eb5c9cca6205f1cb6db17 · sha256:0e709a4806fb1c58… · /containers/cna/affected/37

{"product":"router-cli","vendor":"@tanstack","versions":[{"status":"affected","version":"1.166.46"},{"status":"affected","version":"1.166.49"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:b9b2227464c5cdea55d0368438cc09846f46a4d8a57eb5c9cca6205f1cb6db17 · sha256:0e709a4806fb1c58… · /containers/cna/affected/12

{"product":"zod-adapter","vendor":"@tanstack","versions":[{"status":"affected","version":"1.166.12"},{"status":"affected","version":"1.166.15"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:b9b2227464c5cdea55d0368438cc09846f46a4d8a57eb5c9cca6205f1cb6db17 · sha256:0e709a4806fb1c58… · /containers/cna/affected/41

{"product":"start-fn-stubs","vendor":"@tanstack","versions":[{"status":"affected","version":"1.161.9"},{"status":"affected","version":"1.161.12"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:b9b2227464c5cdea55d0368438cc09846f46a4d8a57eb5c9cca6205f1cb6db17 · sha256:0e709a4806fb1c58… · /containers/cna/affected/28

{"product":"vue-start-client","vendor":"@tanstack","versions":[{"status":"affected","version":"1.166.46"},{"status":"affected","version":"1.166.49"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:b9b2227464c5cdea55d0368438cc09846f46a4d8a57eb5c9cca6205f1cb6db17 · sha256:0e709a4806fb1c58… · /containers/cna/affected/39

Provider-owned CVSS observations

1 source assertion

{"metric":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.6,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","version":"3.1"},"metric_type":"cvssV3_1"}

cve_program_cvelist_v5cvss
urn:baitaphish:normalized-source-record:v2:b9b2227464c5cdea55d0368438cc09846f46a4d8a57eb5c9cca6205f1cb6db17 · sha256:0e709a4806fb1c58… · /containers/cna/metrics/0/cvssV3_1

CWE assertions

1 source assertion

{"cweId":"CWE-506","description":"CWE-506: Embedded Malicious Code","lang":"en","type":"CWE"}

cve_program_cvelist_v5cwe
urn:baitaphish:normalized-source-record:v2:b9b2227464c5cdea55d0368438cc09846f46a4d8a57eb5c9cca6205f1cb6db17 · sha256:0e709a4806fb1c58… · /containers/cna/problemTypes/0/descriptions/0

Known exploitation assertions

2 source assertions

{"cwes":[],"dateAdded":"2026-05-27","dueDate":"2026-06-10","knownRansomwareCampaignUse":"Known","notes":"This vulnerability could affect an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://github.com/TanStack/router/security/advisories/GHSA-g7cv-rxg3-hmpx ; https://nvd.nist.gov/vuln/detail/CVE-2026-45321","product":"TanStack","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product i…

cisa_kev_jsonknown_exploited
urn:baitaphish:normalized-source-record:v2:83a54c7fe838c5b1494dffc8aaa4a822ce6df157ef8ea9cc07904631cfc151c6 · sha256:635dff916c4092c0… · /vulnerabilities/55
Open source location →

cisa_kev_jsonknown_exploited
urn:baitaphish:normalized-source-record:v2:c42d6cf13d0e265d0ad8f087ce90a78c083f518dcd0a673b666a69b90ea4b772 · sha256:16acee8334e59e44… · /vulnerabilities/52
Open source location →

Source references

5 source assertions

{"name":"https://github.com/TanStack/router/issues/7383","tags":["x_refsource_MISC"],"url":"https://github.com/TanStack/router/issues/7383"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:b9b2227464c5cdea55d0368438cc09846f46a4d8a57eb5c9cca6205f1cb6db17 · sha256:0e709a4806fb1c58… · /containers/cna/references/1

{"name":"https://github.com/TanStack/router/security/advisories/GHSA-g7cv-rxg3-hmpx","tags":["x_refsource_CONFIRM"],"url":"https://github.com/TanStack/router/security/advisories/GHSA-g7cv-rxg3-hmpx"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:b9b2227464c5cdea55d0368438cc09846f46a4d8a57eb5c9cca6205f1cb6db17 · sha256:0e709a4806fb1c58… · /containers/cna/references/0

{"name":"https://tanstack.com/blog/npm-supply-chain-compromise-postmortem","tags":["x_refsource_MISC"],"url":"https://tanstack.com/blog/npm-supply-chain-compromise-postmortem"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:b9b2227464c5cdea55d0368438cc09846f46a4d8a57eb5c9cca6205f1cb6db17 · sha256:0e709a4806fb1c58… · /containers/cna/references/2

{"tags":["government-resource"],"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-45321"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:b9b2227464c5cdea55d0368438cc09846f46a4d8a57eb5c9cca6205f1cb6db17 · sha256:0e709a4806fb1c58… · /containers/adp/0/references/0

{"name":"https://www.stepsecurity.io/blog/mini-shai-hulud-is-back-a-self-spreading-supply-chain-attack-hits-the-npm-ecosystem","tags":["x_refsource_MISC"],"url":"https://www.stepsecurity.io/blog/mini-shai-hulud-is-back-a-self-spreading-supply-chain-attack-hits-the-npm-ecosystem"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:b9b2227464c5cdea55d0368438cc09846f46a4d8a57eb5c9cca6205f1cb6db17 · sha256:0e709a4806fb1c58… · /containers/cna/references/3

Attribution and limitations

CISA Known Exploited Vulnerabilities JSON: CISA named for provenance; do not use CISA/DHS marks or imply endorsement Source →
CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer