{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/react-start-1.143.12---1.168.60/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:tanstack:start-server-core:*:*:*:*:*:*:*:*","cpe:2.3:a:tanstack:react-start:*:*:*:*:*:*:*:*","cpe:2.3:a:tanstack:solid-start:*:*:*:*:*:*:*:*","cpe:2.3:a:tanstack:vue-start:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.3,"id":"CVE-2026-102989"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["start-server-core (1.143.12 - \u003c1.169.39)","react-start (1.143.12 - \u003c1.168.60)","solid-start (1.143.12 - \u003c1.168.57)","vue-start (1.143.12 - \u003c1.168.56)"],"_cs_severities":["critical"],"_cs_tags":["xss","web-vulnerability","patch-now"],"_cs_type":"advisory","_cs_vendors":["TanStack"],"content_html":"\u003cp\u003eCVE-2026-102989 is a critical reflected cross-site scripting (XSS) vulnerability affecting TanStack Start framework applications. The issue stems from the server-function transport layer, which improperly allows request payload fields to influence internal middleware state rather than restricting input to defined public fields. An attacker can craft a malformed payload that forces an attacker-controlled result into the error path, which is then incorrectly processed by the response handler as an HTTP response. This allows the attacker to inject arbitrary HTML and execute JavaScript within the application's origin when a victim navigates to a crafted URL. Successful exploitation enables unauthorized access to same-origin data and the ability to perform requests on behalf of the victim.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker identifies a target application utilizing vulnerable versions of TanStack Start.\u003c/li\u003e\n\u003cli\u003eAttacker crafts a malicious URL targeting a server-function endpoint, typically under the \u003ccode\u003e/_serverFn/*\u003c/code\u003e path.\u003c/li\u003e\n\u003cli\u003eAttacker injects a malicious payload into the request fields that influences internal middleware state.\u003c/li\u003e\n\u003cli\u003eThe application receives the request and fails to validate the payload against expected public input fields.\u003c/li\u003e\n\u003cli\u003eThe server-function error path processes the malformed payload, leading to the creation of a response-shaped object containing attacker-supplied content.\u003c/li\u003e\n\u003cli\u003eThe server transmits the malicious response back to the client.\u003c/li\u003e\n\u003cli\u003eThe victim's browser interprets the malicious response, executing the injected JavaScript in the context of the application's origin.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability allows unauthenticated attackers to perform reflected XSS attacks against any user who navigates to a crafted link. This provides the attacker the ability to steal sensitive user data, perform actions as the authenticated user, and bypass same-origin protections. All applications using affected versions of \u003ccode\u003e@tanstack/start-server-core\u003c/code\u003e, \u003ccode\u003e@tanstack/react-start\u003c/code\u003e, \u003ccode\u003e@tanstack/solid-start\u003c/code\u003e, and \u003ccode\u003e@tanstack/vue-start\u003c/code\u003e (version 1.143.12 and above) are exposed until patched.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eUpgrade all affected packages immediately to the following patched versions: \u003ccode\u003e@tanstack/start-server-core@1.169.39\u003c/code\u003e, \u003ccode\u003e@tanstack/react-start@1.168.60\u003c/code\u003e, \u003ccode\u003e@tanstack/solid-start@1.168.57\u003c/code\u003e, and \u003ccode\u003e@tanstack/vue-start@1.168.56\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eImplement a restrictive Content Security Policy (CSP) to limit the execution of unauthorized scripts if patching is delayed.\u003c/li\u003e\n\u003cli\u003eDeploy WAF rules to block requests to \u003ccode\u003e/_serverFn/*\u003c/code\u003e that lack the mandatory \u003ccode\u003ex-tsr-serverFn: true\u003c/code\u003e header.\u003c/li\u003e\n\u003cli\u003eConfigure WAF rules to block requests directed at server-function endpoints that contain headers associated with browser navigations, such as \u003ccode\u003eSec-Fetch-Mode: navigate\u003c/code\u003e or \u003ccode\u003eAccept: text/html\u003c/code\u003e.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-10-15T22:22:36Z","date_published":"2026-10-15T22:22:36Z","id":"https://feed.craftedsignal.io/briefs/2026-10-tanstack-xss/","summary":"A critical reflected XSS vulnerability (CVE-2026-102989) in TanStack Start server-functions allows unauthenticated attackers to execute arbitrary JavaScript in the context of the application origin.","title":"Reflected XSS in TanStack Start Server-Functions","url":"https://feed.craftedsignal.io/briefs/2026-10-tanstack-xss/"}],"language":"en","title":"CraftedSignal Threat Feed - React-Start (1.143.12 - \u003c1.168.60)","version":"https://jsonfeed.org/version/1.1"}