CVE-2026-102989: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in TanStack router

TanStack Router versions from 1.143.12 up to but excluding 1.169.39 (@tanstack/start-server-core), 1.168.60 (@tanstack/react-start), 1.168.57 (@tanstack/solid-start), and 1.168.56 (@tanstack/vue-start) contain a CWE-79 improper input neutralization vulnerability. An unauthenticated attacker can manipulate non-public fields in server-function request payloads so that attacker-controlled middleware state reaches an error path, causing a response-shaped object to be accepted as an HTTP response. This allows crafted URLs to return attacker-controlled HTML from the application's origin, enabling cross-site scripting attacks that can access same-origin data and issue requests with the visitor's authority. The vulnerability has a CVSS 3.1 score of 9.3 (critical) with network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and high confidentiality and integrity impact but no availability impact. Official patches are available in the specified fixed versions.

Successful exploitation allows an unauthenticated attacker to execute arbitrary scripts in the context of the vulnerable web application origin. This can lead to theft of sensitive data accessible to the application, unauthorized actions performed with the visitor's privileges, and compromise of user trust. The vulnerability does not impact availability but has high confidentiality and integrity impact. The attack requires user interaction (visiting a crafted URL).

This vulnerability is fixed in @tanstack/start-server-core version 1.169.39, @tanstack/react-start version 1.168.60, @tanstack/solid-start version 1.168.57, and @tanstack/vue-start version 1.168.56. Users should upgrade to these versions or later to remediate the issue. No other mitigation or temporary workaround is indicated by the vendor advisory.