CVE-2026-102989 is a critical cross-site scripting (XSS) vulnerability in TanStack router affecting multiple related packages. An unauthenticated attacker can craft a malicious URL that causes the application to return attacker-controlled HTML and execute JavaScript in the context of the victim's browser. This allows access to same-origin data and the ability to make requests with the victim's authority. The issue arises from improper handling of server-function input and response validation. Patched versions are available and upgrading is recommended. Temporary mitigations include edge or WAF rules and restrictive Content Security Policies, but these are not complete fixes.
### Impact
ACL checks ran on the lexical vault-relative path while containment used the realpath. An in-vault symlink placed under an allowed glob, whose realpath resolved into a denied folder, passed the read ACL — an intra-vault read-ACL-scope bypass. It requires an out-of-band-planted symlink (no MCP tool creates one) and is not a vault-root escape.
### Patches
Fixed in **1.3.1**. Upgrade to `>= 1.3.1`. ACL enforcement now derives the realpath vault-relative path and feeds a single unified predicate at every site.
### Workarounds
Do not permit untrusted symlinks inside the vault.
The npm package @chatest/baileys versions 4.4.0 and 4.4.1 includes a dependency on an unpinned GitHub repository (libsignal-node) that can execute arbitrary code during installation. The package is branded inconsistently, suggesting potential impersonation. Installing this package can lead to full system compromise, requiring immediate secret and key rotation and package removal.
The npm package @user-interface-common/common-styles version 66.1.6 is a malicious package published as part of a dependency confusion campaign. It includes a preinstall script that runs code sending an HTTPS request to an attacker-controlled server, leaking the victim's public IP address and identifying information about the installed package. This behavior indicates that any system installing this package may be compromised.
The npm package '@mntv-analysis/workspaces-components' version 65.11.3 is a malicious package published by the user 'conx3993' as part of a dependency confusion attack. It contains a preinstall script that executes code sending an HTTPS GET request to an attacker-controlled server with a hardcoded authorization token and the installer's public IP address. This behavior acts as a reconnaissance beacon to identify victims who install the squatted package. The package itself performs no legitimate function and is considered fully compromising to any system where it is installed.
The npm package @mntv-analysis/ui-components version 50.1.1 is a malicious package published by the user 'conx3993' as part of a dependency confusion attack. It masquerades as an internal package and executes a preinstall script that sends an HTTPS request to an attacker-controlled server, leaking the victim's public IP address and signaling successful installation. The package contains no legitimate UI component code and serves solely as a tracking beacon.
The npm package '@mntv-analysis/ui' version 99.1.1 is a malicious package published by the user 'conx3993' as part of a dependency confusion attack. It masquerades as an internal package and uses a high version number to be preferentially resolved by misconfigured package resolvers. During installation, a preinstall script runs that sends an HTTPS request to an attacker-controlled server, leaking the victim's public IP address and a unique authorization token identifying the installed package. The package contains no legitimate UI functionality and acts as a beacon to tag victims. Systems with this package installed should be considered fully compromised.
The npm package 'monkey-tags-ip' version 53.4.1 is a malicious package published as part of a dependency confusion campaign. It masquerades as an internal package and executes a preinstall script that sends an HTTPS request to an attacker-controlled server, leaking the victim's public IP address and installation event. The package also declares a dependency on a third-party 'https' package, potentially introducing additional malicious code. The package has no legitimate functionality and is designed solely to beacon installation details to an external actor.
### Impact
Tool dispatch did not check the caller-supplied `input.vault` against the caller's bound vault (`ctx.vaultId`); the folder ACL was a single global instance and the JWT carried no vault claim. As a result, **any valid token could read, write, or delete any configured vault** by passing `input.vault`, defeating multi-tenant isolation across ~90 tool sites. (`resources/read` was the only surface that already guarded this.)
### Patches
Fixed in **1.3.1** (the fix was developed on the `v1.3.0` tag, which never published to npm; 1.3.1 is the first published release with the fix). Upgrade to `>= 1.3.1`.
### Workarounds
Run a single vault per server process, or isolate each tenant on a separate process/credential.
### Fix
A central `input.vault === ctx.vaultId` guard was added in dispatch before the scope check.
### Impact
With a default configuration, an undefined `readPaths`/`writePaths` meant allow-all, the `strictReadDefault` flag was inert, and the `.obsidian`/`.git`/`.trash` control directories were denied only during enumeration — not on the direct request path. A caller could read `.obsidian/plugins/*/data.json`, exfiltrating **plugin API keys and Obsidian Sync passwords** (live-reproduced), as well as any other in-vault file by path.
### Patches
Fixed in **1.3.1**. Upgrade to `>= 1.3.1`. The default now denies `.obsidian`/`.git`/`.trash` on read/write/delete and honors `strictReadDefault` on the request path.
### Workarounds
Set an explicit `readPaths`/`writePaths` whitelist that excludes the control directories.
The @zanta/baileys npm package, a fork of the Baileys WhatsApp Web library, contains malicious code that automatically subscribes the user's authenticated WhatsApp account to a specific WhatsApp Channel controlled by the publisher without user consent. This behavior occurs during the login-success event and is present in versions 1.0.0 and 1.0.1. The package does not exfiltrate credentials or maintain persistence, but it covertly inflates the publisher's channel subscribers using the victim's account.
The npm package @yudzxml/baileys contains malicious code that compromises any computer on which it is installed or running. The presence of this package indicates a full system compromise, requiring immediate rotation of all secrets and keys from a different, trusted machine. Simply removing the package does not guarantee removal of all malicious software introduced.
The npm package @xrelly-stack/bails contains malicious code that fully compromises any computer on which it is installed or running. The presence of this package means that all secrets and keys stored on the affected computer should be considered compromised and must be rotated from a separate, secure device. Removing the package alone does not guarantee removal of all malicious software introduced by it.
The node-telegram-sockets npm package contains malicious code that fully compromises any computer on which it is installed or running. This compromise allows an attacker to gain full control over the affected system. Immediate removal of the package is recommended, but due to the extent of control gained, complete remediation may require rotating all secrets and keys from a separate, uncompromised device.
The npm package '@wanzxlonelyy/bailslonely' contains malicious code that fully compromises any computer on which it is installed or running. Removal of the package does not guarantee elimination of all malicious software, as the attacker may have gained full control. Immediate rotation of all secrets and keys stored on the affected computer is strongly advised.
The npm package @wanzlonelyy/bailslonely contains malicious code that can fully compromise any computer on which it is installed or running. The compromise may allow an attacker full control over the system, risking exposure of all stored secrets and keys. Immediate removal of the package is recommended, but due to potential persistent control, rotating all secrets from a different, trusted computer is essential.
The npm package @wanzlonely/bails4u versions 2.0.0, 3.0.0, 4.0.0, and 5.0.0 are malicious forks of the Baileys WhatsApp Web library. These versions contain injected code that silently subscribes the victim's WhatsApp account to attacker-controlled channels using the victim's authenticated session. The malicious code does not steal credentials, establish persistence, or execute arbitrary remote code, and the targeted channels are obfuscated or dynamically fetched to evade detection.
The npm package 'bailslonely' contains malicious code that fully compromises any computer on which it is installed or running. The compromise allows an attacker to potentially gain full control over the affected system. Immediate removal of the package is recommended, but due to the extent of the compromise, complete remediation may require additional measures such as rotating all secrets and keys from a separate, trusted machine.
The npm package @wanzlonely/bailsforme contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, trusted device. Removal of the package alone may not fully eliminate the malicious presence, as the attacker may have established persistent control over the system.
The npm package '@wanzlonely/bailsme' contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, trusted machine. Removing the package alone does not guarantee removal of all malicious software, as the attacker may have established persistent control over the system.