CVE-2026-102989: Critical Unauthenticated XSS in TanStack Start

CVE-2026-102989: Critical Unauthenticated XSS in TanStack Start

In short

A critical vulnerability, identified as CVE-2026-102989, with a CVSS score of 9.3 out of 10 [1], has been published affecting web applications built with TanStack Start. The flaw allows an attacker, without needing credentials or a user account, to get the application to return a page with manipulated content from the company's own domain, which can lead to data theft or unauthorized actions on behalf of the victim. If your development team uses this framework, the immediate recommendation is to update to the fixed versions and review which applications in production use it.

What it is and why it matters

TanStack Start is a framework for building web applications that combine client-side and server-side logic, available in variants for React, Solid, and Vue. The vulnerability lies in how "server functions" process requests: an attacker can include fields in the request that should not be manipulable from outside, causing the application's internal state to end up accepting an object shaped like an HTTP response as if it were a legitimate response [1]. The practical result is that a specially crafted URL can make the application return HTML controlled by the attacker, including JavaScript code, served from the company's actual domain.

According to the analysis by the OCIRIA team, this is a reflected XSS (cross-site scripting) injection that does not require prior authentication by the attacker, which makes it particularly concerning: it is enough for a legitimate user to click on a manipulated link for the script to execute in their browser, with access to same-origin data and the ability to make requests with that person's identity.

The vulnerability was published on October 13, 2026 [1] and is rated as "critical" according to NVD criteria [1]. As of this post, it does not appear in CISA's catalog of actively exploited vulnerabilities (KEV) [2], which indicates there is no public record of confirmed mass exploitation, although this may change and should not be interpreted as an absence of risk.

Who is affected

The problem affects the following packages in the TanStack Start ecosystem, within the version ranges indicated before their fix [3]:

• @tanstack/start-server-core: from 1.143.12 to 1.169.39
• @tanstack/react-start: up to 1.168.60
• @tanstack/solid-start: up to 1.168.57
• @tanstack/vue-start: up to 1.168.56

Any organization with its own web applications or those commissioned from third parties built on any of these packages is potentially exposed, regardless of company size or sector. This is not a specific commercial product from a vendor, but a piece of development infrastructure that may be integrated into customer portals, intranets, admin panels, or mobile applications with a web backend.

How to know if you are vulnerable

The first step is to ask whoever develops or maintains your web applications whether they use TanStack Start and, if so, which version of the affected packages they have installed. Checking the dependency file (package.json or the corresponding lockfile) is usually enough to identify the exact version.

It is also advisable to check which company applications and subdomains are publicly exposed on the internet, since the full inventory of digital assets is not always up to date, especially in organizations with several development teams or external providers. Knowing the actual exposed surface is the starting point for prioritizing what to review first.

How to protect yourself

1. Identify whether any company application uses TanStack Start and in which version.

2. Update to the fixed versions as soon as possible: @tanstack/start-server-core 1.169.39, @tanstack/react-start 1.168.60, @tanstack/solid-start 1.168.57, or @tanstack/vue-start 1.168.56, depending on the package you use [3].

3. If you cannot update immediately, ask your technical team or provider to review the validation logic of the server functions as a temporary measure.

4. Audit production applications after the update to confirm that behavior is as expected.

5. Periodically review which technologies and versions your exposed applications use, not only in response to a one-time alert.

FAQ

Do I need to have an account or compromised credentials to be a victim of this attack?

No. The flaw does not require authentication by the attacker to construct the malicious URL; the victim only needs to visit it [1].

Is this vulnerability being actively exploited?

As of today, it does not appear in CISA's KEV catalog, which lists vulnerabilities with confirmed exploitation [2]. That does not guarantee it will not be exploited in the future, so it is recommended to act with the same priority as with any critical flaw.

Does it only affect those using React?

No. It also affects the Solid and Vue variants of the framework, as well as the core server package [3].

Sources

• [1] https://nvd.nist.gov/vuln/detail/CVE-2026-102989
• [2] https://raw.githubusercontent.com/cisagov/kev-data/develop/known_exploited_vulnerabilities.json
• [3] https://github.com/advisories/GHSA-qx66-fv34-fjm8