CVE-2026-78177: OS Command Injection in TanStack devtools-vite

The vulnerability exists in the installPackage function of the file packages/devtools-bundler-core/src/package-manager.ts in TanStack devtools-vite 0.7.0. Manipulating the packageName argument can lead to OS command injection. The attack requires local access and is considered difficult to exploit due to high complexity. The issue was reported early to the project, but no official fix or response has been provided. Public exploit code is available, but no known exploitation in the wild has been observed.

Successful exploitation could allow an attacker with local access to execute arbitrary OS commands via the packageName argument in the installPackage function. However, the attack complexity is high, and the CVSS score is low, indicating limited impact and difficulty in exploitation. No evidence of active exploitation in the wild has been reported.

No official fix or patch is currently available. Users should monitor the vendor's communications for updates. Given the requirement for local access and high complexity, limiting local user privileges and avoiding untrusted input to the installPackage function can reduce risk. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.