A vulnerability was found in TanStack devtools-vite 0.7.0. (CVE-2026-78177)
CVE-2026-78177 is a vulnerability in TanStack devtools-vite version 0.7.0 affecting the installPackage function in the Development Devtools Event Bus component. It allows OS command injection via manipulation of the packageName argument. Exploitation requires local access and has a high complexity, making it difficult to exploit. No patch or vendor response has been reported yet. The vulnerability has a low CVSS score of 4.5 and no known exploits in the wild.
AI Analysis
Technical Summary
This vulnerability exists in the installPackage function of the file packages/devtools-bundler-core/src/package-manager.ts within TanStack devtools-vite 0.7.0. The issue is an OS command injection caused by improper handling of the packageName argument. Successful exploitation requires local access with low privileges and no user interaction, but the attack complexity is high. The vulnerability was responsibly disclosed early to the project, which has not yet responded or issued a fix. The CVSS 3.1 base score is 4.5, reflecting low impact on confidentiality, integrity, and availability.
Potential Impact
The vulnerability could allow an attacker with local access to execute arbitrary OS commands via the packageName argument, potentially leading to limited confidentiality, integrity, and availability impacts. However, the high attack complexity and requirement for local access reduce the likelihood and scope of exploitation. There are no known active exploits in the wild.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the project has not responded or issued a fix, users should avoid local untrusted input to the installPackage function or restrict local access until a patch is available.
A vulnerability was found in TanStack devtools-vite 0.7.0. (CVE-2026-78177)
Description
CVE-2026-78177 is a vulnerability in TanStack devtools-vite version 0.7.0 affecting the installPackage function in the Development Devtools Event Bus component. It allows OS command injection via manipulation of the packageName argument. Exploitation requires local access and has a high complexity, making it difficult to exploit. No patch or vendor response has been reported yet. The vulnerability has a low CVSS score of 4.5 and no known exploits in the wild.
CVSS v3.1
Score 4.5medium
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability exists in the installPackage function of the file packages/devtools-bundler-core/src/package-manager.ts within TanStack devtools-vite 0.7.0. The issue is an OS command injection caused by improper handling of the packageName argument. Successful exploitation requires local access with low privileges and no user interaction, but the attack complexity is high. The vulnerability was responsibly disclosed early to the project, which has not yet responded or issued a fix. The CVSS 3.1 base score is 4.5, reflecting low impact on confidentiality, integrity, and availability.
Potential Impact
The vulnerability could allow an attacker with local access to execute arbitrary OS commands via the packageName argument, potentially leading to limited confidentiality, integrity, and availability impacts. However, the high attack complexity and requirement for local access reduce the likelihood and scope of exploitation. There are no known active exploits in the wild.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the project has not responded or issued a fix, users should avoid local untrusted input to the installPackage function or restrict local access until a patch is available.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-7f75-jp7p-2wcj
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-78177"]
- Ecosystems
- []
- Database Specific Severity
- LOW
- Cvss Version
- 3.1
Threat ID: 6a8c4c75acd9273b499c0e6a
Added to database: 08/24/2026, 13:51:49 UTC
Last enriched: 08/24/2026, 14:29:53 UTC
Last updated: 08/25/2026, 02:51:59 UTC
Views: 6
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.