Cpe:2.3:a:tanstack:react-Start:*:*:*:*:*:*:*:*

A critical reflected XSS vulnerability (CVE-2026-102989) in TanStack Start server-functions allows unauthenticated attackers to execute arbitrary JavaScript in the context of the application origin.