Threats tagged 'ghsa-qx66-fv34-fjm8'

CVE-2026-102989 is a critical cross-site scripting (XSS) vulnerability in TanStack router affecting multiple related packages. An unauthenticated attacker can craft a malicious URL that causes the application to return attacker-controlled HTML and execute JavaScript in the context of the victim's browser. This allows access to same-origin data and the ability to make requests with the victim's authority. The issue arises from improper handling of server-function input and response validation. Patched versions are available and upgrading is recommended. Temporary mitigations include edge or WAF rules and restrictive Content Security Policies, but these are not complete fixes.