@tanstack/vue-start has 1 advisory. Version not read yet.
npm ↗Versions
Red: affected by at least one advisory. White: safe. The dot is the version in your lockfile.
Details
- You run
- not in lockfile
- Safe
- 1.168.56
- Advisories
- 1 in 120 days
Used by
Stacks that pull this package.
Not part of a tracked stack.
Alerts(1)
Source summary
Impact An unauthenticated attacker can craft a URL to a server function in an affected TanStack Start app. If someone opens the link, the app can return attacker-controlled HTML from its own origin and run the attacker's JavaScript there. The script can access same-origin data available to that visitor and make requests with their authority. Cause The server-function transport can pass request payload fields into internal middleware state instead of limiting them to public input fields. A malformed payload can leave an attacker-controlled result in the error path. Response handling can then tr
- Affected
- @tanstack/start-server-core >=1.143.12 <1.169.39 · @tanstack/react-start >=1.143.12 <1.168.60 · @tanstack/solid-start >=1.143.12 <1.168.57 · @tanstack/vue-start >=1.143.12 <1.168.56
- Fixed in
- 1.169.39 · 1.168.60 · 1.168.57 · 1.168.56
- ID
- GHSA-qx66-fv34-fjm8