BDU:2026-06725

Опубликовано: 12 мая 2026

Источник: fstec

CVSS3: 9.6

CVSS2: 10

EPSS Низкий

Описание

Уязвимость набора библиотек TanStack связана с наличием недекларированных возможностей. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, выполнить произвольный код

Вендор

Сообщество свободного программного обеспечения

Наименование ПО

react-server-dom-parcel

eslint-plugin-router

eslint-plugin-start

history

nitro-v2-vite-plugin

react-router

react-router-devtools

react-router-ssr-query

react-start

react-start-client

react-start-rsc

react-start-server

router-cli

router-core

router-devtools

router-devtools-core

router-generator

router-plugin

router-ssr-query-core

router-utils

router-vite-plugin

solid-router

solid-router-devtools

solid-router-ssr-query

solid-start

solid-start-client

solid-start-server

start-client-core

start-fn-stubs

start-plugin-core

start-server-core

start-static-server-functions

start-storage-context

valibot-adapter

virtual-file-routes

vue-router

vue-router-devtools

vue-router-ssr-query

vue-start

vue-start-client

vue-start-server

zod-adapter

Версия ПО

1.166.12 (react-server-dom-parcel)

1.166.15 (react-server-dom-parcel)

1.161.9 (eslint-plugin-router)

1.161.12 (eslint-plugin-router)

0.0.4 (eslint-plugin-start)

0.0.7 (eslint-plugin-start)

1.161.9 (history)

1.161.12 (history)

1.154.12 (nitro-v2-vite-plugin)

1.154.15 (nitro-v2-vite-plugin)

1.169.5 (react-router)

1.169.8 (react-router)

1.166.16 (react-router-devtools)

1.166.19 (react-router-devtools)

1.166.15 (react-router-ssr-query)

1.166.18 (react-router-ssr-query)

1.167.68 (react-start)

1.167.71 (react-start)

1.166.51 (react-start-client)

1.166.54 (react-start-client)

0.0.47 (react-start-rsc)

0.0.50 (react-start-rsc)

1.166.55 (react-start-server)

1.166.58 (react-start-server)

1.166.46 (router-cli)

1.166.49 (router-cli)

1.169.5 (router-core)

1.169.8 (router-core)

1.166.16 (router-devtools)

1.166.19 (router-devtools)

1.167.6 (router-devtools-core)

1.167.9 (router-devtools-core)

1.166.45 (router-generator)

1.166.48 (router-generator)

1.167.38 (router-plugin)

1.167.41 (router-plugin)

1.168.3 (router-ssr-query-core)

1.168.6 (router-ssr-query-core)

1.161.11 (router-utils)

1.161.14 (router-utils)

1.166.53 (router-vite-plugin)

1.166.56 (router-vite-plugin)

1.169.5 (solid-router)

1.169.8 (solid-router)

1.166.16 (solid-router-devtools)

1.166.19 (solid-router-devtools)

1.166.15 (solid-router-ssr-query)

1.166.18 (solid-router-ssr-query)

1.167.65 (solid-start)

1.167.68 (solid-start)

1.166.50 (solid-start-client)

1.166.53 (solid-start-client)

1.166.54 (solid-start-server)

1.166.57 (solid-start-server)

1.168.5 (start-client-core)

1.168.8 (start-client-core)

1.161.9 (start-fn-stubs)

1.161.12 (start-fn-stubs)

1.169.23 (start-plugin-core)

1.169.26 (start-plugin-core)

1.167.33 (start-server-core)

1.167.36 (start-server-core)

1.166.44 (start-static-server-functions)

1.166.47 (start-static-server-functions)

1.166.38 (start-storage-context)

1.166.41 (start-storage-context)

1.166.12 (valibot-adapter)

1.166.15 (valibot-adapter)

1.161.10 (virtual-file-routes)

1.161.13 (virtual-file-routes)

1.169.5 (vue-router)

1.169.8 (vue-router)

1.166.16 (vue-router-devtools)

1.166.19 (vue-router-devtools)

1.166.15 (vue-router-ssr-query)

1.166.18 (vue-router-ssr-query)

1.167.61 (vue-start)

1.167.64 (vue-start)

1.166.46 (vue-start-client)

1.166.49 (vue-start-client)

1.166.50 (vue-start-server)

1.166.53 (vue-start-server)

1.166.12 (zod-adapter)

1.166.15 (zod-adapter)

Тип ПО

Прикладное ПО информационных систем

Операционные системы и аппаратные платформы

Уровень опасности уязвимости

Критический уровень опасности (базовая оценка CVSS 2.0 составляет 10)

Критический уровень опасности (базовая оценка CVSS 3.1 составляет 9,6)

Возможные меры по устранению уязвимости

Использование рекомендаций производителя:

https://github.com/TanStack/router/security/advisories/GHSA-g7cv-rxg3-hmpx

https://github.com/TanStack/router/issues/7383

Статус уязвимости

Подтверждена производителем

Наличие эксплойта

Существует в открытом доступе

Информация об устранении

Уязвимость устранена

Ссылки на источники

Идентификаторы других систем описаний уязвимостей

EPSS

Процентиль: 82%

0.02342

Низкий

9.6 Critical

CVSS3

10 Critical

CVSS2

Связанные уязвимости

CVE-2026-45321

CVSS3: 9.6

nvd

3 месяца назад

On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for TanStack/router, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes — a pull_request_target "Pwn Request" misconfiguration, GitHub Actions cache poisoning across the fork↔base trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process — to publish credential-stealing malware under a trusted identity. Each affected package received exactly two malicious versions, published a few minutes apart.

GHSA-g7cv-rxg3-hmpx

CVSS3: 9.6

github

3 месяца назад

Malware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys

EPSS

Процентиль: 82%

0.02342

Низкий

9.6 Critical

CVSS3

10 Critical

CVSS2