CRITICALCVSS 9.6Actively exploited · CISA KEV since 2026-05-27Vulnerability

CVE-2026-45321

TanStack contains an unspecified vulnerability that allowed malicious versions of the product to be published to the npm registry to publish credential-stealing malware under a trusted identity.

Properties

Vulnerability name
TanStack Unspecified Vulnerability
Epss score
0.01054
Last seen
2026-10-19T12:00:27+00:00
Due date
2026-06-10
Exploited euvd since
2026-05-27T00:00:00+00:00
Date added
2026-05-27
Source url
https://epss.empiricalsecurity.com/epss_scores-2026-10-19.csv.gz
Ghsa updated
2026-05-13T16:25:19Z
Score
9.6
Euvd base score version
3.1
Euvd vendor
@tanstack
In Signal since
initial import (Sep 2026)
Euvd base score
9.6
Is ghsa only
false
Vendor project
TanStack
Content hash
0dec57101a2e53d9a5b0e62416cceaca582f6d15c6a1068d9d04dab45c3ad5b3
Published at
2026-05-12T01:16:46.820
Euvd updated
2026-08-04T03:56:09+00:00
Last modified
2026-06-17T10:51:54.877
Euvd epss pct
1.05

Related Entities (430 · showing 63)

AFFECTS_PRODUCT (343 · showing 20)

→[Product]cpe:2.3:a:tanstack:tanstack\/react-router-devtools:1.166.16:*:*:*:*:node.js:*:*
→[Product]cpe:2.3:a:uipath:uipath\/ui-widgets-multi-file-upload:1.0.1:*:*:*:*:node.js:*:*
→[Product]cpe:2.3:a:uipath:uipath\/vertical-solutions-tool:1.0.1:*:*:*:*:node.js:*:*
→[Product]cpe:2.3:a:uipath:uipath\/rpa-tool:0.9.5:*:*:*:*:node.js:*:*
→[Product]cpe:2.3:a:uipath:uipath\/telemetry:0.0.7:*:*:*:*:node.js:*:*
→[Product]cpe:2.3:a:uipath:uipath\/resourcecatalog-tool:0.1.1:*:*:*:*:node.js:*:*
→[Product]cpe:2.3:a:uipath:uipath\/packager-tool-workflowcompiler-browser:0.0.34:*:*:*:*:node.js:*:*
→[Product]cpe:2.3:a:uipath:uipath\/test-manager-tool:1.0.2:*:*:*:*:node.js:*:*
→[Product]cpe:2.3:a:uipath:uipath\/solution-packager:0.0.35:*:*:*:*:node.js:*:*
→[Product]cpe:2.3:a:uipath:uipath\/solutionpackager-tool-core:0.0.34:*:*:*:*:node.js:*:*
→[Product]cpe:2.3:a:uipath:uipath\/robot:1.3.4:*:*:*:*:node.js:*:*
→[Product]cpe:2.3:a:uipath:uipath\/resources-tool:0.1.11:*:*:*:*:node.js:*:*
→[Product]cpe:2.3:a:uipath:uipath\/tasks-tool:1.0.1:*:*:*:*:node.js:*:*
→[Product]cpe:2.3:a:uipath:uipath\/solutionpackager-sdk:1.0.11:*:*:*:*:node.js:*:*
→[Product]cpe:2.3:a:uipath:uipath\/widget.sdk:1.2.3:*:*:*:*:node.js:*:*
→[Product]cpe:2.3:a:uipath:uipath\/platform-tool:1.0.1:*:*:*:*:node.js:*:*
→[Product]cpe:2.3:a:uipath:uipath\/vss:0.1.6:*:*:*:*:node.js:*:*
→[Product]cpe:2.3:a:uipath:uipath\/traces-tool:1.0.1:*:*:*:*:node.js:*:*
→[Product]cpe:2.3:a:uipath:uipath\/resource-tool:1.0.1:*:*:*:*:node.js:*:*
→[Product]cpe:2.3:a:uipath:uipath\/solution-tool:1.0.1:*:*:*:*:node.js:*:*

AFFECTS (42 · showing 20)

→[Software]npm/@tanstack/start-server-core
→[Software]npm/@tanstack/virtual-file-routes
→[Software]npm/@tanstack/start-storage-context
→[Software]npm/@tanstack/zod-adapter
→[Software]npm/@tanstack/vue-start
→[Software]npm/@tanstack/vue-router
→[Software]npm/@tanstack/vue-router-ssr-query
→[Software]npm/@tanstack/vue-start-server
→[Software]npm/@tanstack/valibot-adapter
→[Software]npm/@tanstack/vue-start-client
→[Software]npm/@tanstack/vue-router-devtools
→[Software]npm/@tanstack/router-devtools-core
→[Software]npm/@tanstack/router-cli
→[Software]npm/@tanstack/router-devtools
→[Software]npm/@tanstack/history
→[Software]npm/@tanstack/react-start-client
→[Software]npm/@tanstack/start-fn-stubs
→[Software]npm/@tanstack/react-router-devtools
→[Software]npm/@tanstack/react-start-server
→[Software]npm/@tanstack/router-ssr-query-core

VULNERABLE_TO (42 · showing 20)

←[Software]npm/@tanstack/router-cli
←[Software]npm/@tanstack/zod-adapter
←[Software]npm/@tanstack/vue-start-client
←[Software]npm/@tanstack/vue-start
←[Software]npm/@tanstack/valibot-adapter
←[Software]npm/@tanstack/start-storage-context
←[Software]npm/@tanstack/vue-router-ssr-query
←[Software]npm/@tanstack/vue-router-devtools
←[Software]npm/@tanstack/vue-start-server
←[Software]npm/@tanstack/vue-router
←[Software]npm/@tanstack/virtual-file-routes
←[Software]npm/@tanstack/eslint-plugin-start
←[Software]npm/@tanstack/solid-start-server
←[Software]npm/@tanstack/router-plugin
←[Software]npm/@tanstack/react-router-devtools
←[Software]npm/@tanstack/solid-router-devtools
←[Software]npm/@tanstack/router-utils
←[Software]npm/@tanstack/arktype-adapter
←[Software]npm/@tanstack/router-generator
←[Software]npm/@tanstack/router-devtools

DESCRIBES (1)

←[KEVEntry]TanStack Unspecified Vulnerability

HAS_WEAKNESS (1)

→[Weakness]Embedded Malicious Code

INVOLVES (1)

←[Signal]kev_added · 2026-05-27

Explore deeper with Ninja Signal's threat intelligence graph

Search in SpektrOpen Signal Desktop
CVE-2026-45321 (CVSS 9.6) — Ninja Signal Threat Intelligence | Ninja Signal