Vigie VulnDBEuropean-hosted Vulnerability DB

CVE-2026-45321

Malware in 42 @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys

At a glance

Severity
CRITICAL 9.6
Exploitation
Known exploited (CISA KEV) · added 2026-05-27
Exploited per ENISA since 2026-05-27
EPSS
EPSS 3.28 % · percentile 88 (2026-10-27)
State
PUBLISHED
Published
Updated
Assigner
GitHub_M
NVD status
Analyzed

Description

On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for TanStack/router, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes — a pull_request_target "Pwn Request" misconfiguration, GitHub Actions cache poisoning across the fork↔base trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process — to publish credential-stealing malware under a trusted identity. Each affected package received exactly two malicious versions, published a few minutes apart.

Scores

VersionScoreVectorScored by
CVSS 3.1CRITICAL 9.6CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:HGitHub_M
CVSS 3.1CRITICAL 9.6CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:HNVD · security-advisories@github.com (Secondary)

Weaknesses (CWE)

Advisories

European references

Affected configurations (NVD CPE)

Affected products

ProductVersions
@tanstack · arktype-adapteraffected 1.166.12 ; affected 1.166.15
@tanstack · eslint-plugin-routeraffected 1.161.9 ; affected 1.161.12
@tanstack · eslint-plugin-startaffected 0.0.4 ; affected 0.0.7
@tanstack · historyaffected 1.161.9 ; affected 1.161.12
@tanstack · nitro-v2-vite-pluginaffected 1.154.12 ; affected 1.154.15
@tanstack · react-routeraffected 1.169.5 ; affected 1.169.8
@tanstack · react-router-devtoolsaffected 1.166.16 ; affected 1.166.19
@tanstack · react-router-ssr-queryaffected 1.166.15 ; affected 1.166.18
@tanstack · react-startaffected 1.167.68 ; affected 1.167.71
@tanstack · react-start-clientaffected 1.166.51 ; affected 1.166.54
@tanstack · react-start-rscaffected 0.0.47 ; affected 0.0.50
@tanstack · react-start-serveraffected 1.166.55 ; affected 1.166.58
@tanstack · router-cliaffected 1.166.46 ; affected 1.166.49
@tanstack · router-coreaffected 1.169.5 ; affected 1.169.8
@tanstack · router-devtoolsaffected 1.166.16 ; affected 1.166.19
@tanstack · router-devtools-coreaffected 1.167.6 ; affected 1.167.9
@tanstack · router-generatoraffected 1.166.45 ; affected 1.166.48
@tanstack · router-pluginaffected 1.167.38 ; affected 1.167.41
@tanstack · router-ssr-query-coreaffected 1.168.3 ; affected 1.168.6
@tanstack · router-utilsaffected 1.161.11 ; affected 1.161.14

References

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
CISA Known Exploited VulnerabilitiesCC0 1.0
EPSS (FIRST.org)FIRST — attribution requested
ENISA EUVDENISA — reproduction authorised, source acknowledged
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD