{"history":[{"alert":0,"cve":"CVE-2026-45321","id":23428,"kind":"epss","observed_at":1794500401,"payload":"{\"date\": \"2026-11-12\", \"epss\": 0.03278, \"percentile\": 0.88603}"},{"alert":0,"cve":"CVE-2026-45321","id":20749,"kind":"epss","observed_at":1794327601,"payload":"{\"date\": \"2026-11-10\", \"epss\": 0.03278, \"percentile\": 0.8853}"},{"alert":0,"cve":"CVE-2026-45321","id":18750,"kind":"epss","observed_at":1794241201,"payload":"{\"date\": \"2026-11-09\", \"epss\": 0.03278, \"percentile\": 0.88515}"},{"alert":0,"cve":"CVE-2026-45321","id":16821,"kind":"epss","observed_at":1794154800,"payload":"{\"date\": \"2026-11-08\", \"epss\": 0.03278, \"percentile\": 0.88508}"},{"alert":0,"cve":"CVE-2026-45321","id":14799,"kind":"epss","observed_at":1794068402,"payload":"{\"date\": \"2026-11-07\", \"epss\": 0.03278, \"percentile\": 0.885}"},{"alert":0,"cve":"CVE-2026-45321","id":12586,"kind":"epss","observed_at":1793982001,"payload":"{\"date\": \"2026-11-06\", \"epss\": 0.03278, \"percentile\": 0.88483}"},{"alert":0,"cve":"CVE-2026-45321","id":10571,"kind":"epss","observed_at":1793938800,"payload":"{\"date\": \"2026-11-05\", \"epss\": 0.03278, \"percentile\": 0.88473}"},{"alert":0,"cve":"CVE-2026-45321","id":8121,"kind":"epss","observed_at":1793809200,"payload":"{\"date\": \"2026-11-04\", \"epss\": 0.03278, \"percentile\": 0.88463}"},{"alert":0,"cve":"CVE-2026-45321","id":5903,"kind":"epss","observed_at":1793722800,"payload":"{\"date\": \"2026-11-03\", \"epss\": 0.03278, \"percentile\": 0.88442}"},{"alert":1,"cve":"CVE-2026-45321","id":3846,"kind":"cna","observed_at":1793701200,"payload":"{\"containers\": {\"adp\": [{\"metrics\": [{\"other\": {\"content\": {\"id\": \"CVE-2026-45321\", \"options\": [{\"Exploitation\": \"active\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"role\": \"CISA Coordinator\", \"timestamp\": \"2026-05-27T00:00:00+00:00\", \"version\": \"2.0.3\"}, \"type\": \"ssvc\"}}, {\"other\": {\"content\": {\"dateAdded\": \"2026-05-27\", \"reference\": \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-45321\"}, \"type\": \"kev\"}}], \"providerMetadata\": {\"dateUpdated\": \"2026-08-04T03:56:09.005Z\", \"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\"}, \"references\": [{\"tags\": [\"government-resource\"], \"url\": \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-45321\"}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2026-05-27T00:00:00.000Z\", \"value\": \"CVE-2026-45321 added to CISA KEV\"}], \"title\": \"CISA ADP Vulnrichment\"}], \"cna\": {\"affected\": [{\"product\": \"arktype-adapter\", \"vendor\": \"@tanstack\", \"versions\": [{\"status\": \"affected\", \"version\": \"1.166.12\"}, {\"status\": \"affected\", \"version\": \"1.166.15\"}]}, {\"product\": \"eslint-plugin-router\", \"vendor\": \"@tanstack\", \"versions\": [{\"status\": \"affected\", \"version\": \"1.161.9\"}, {\"status\": \"affected\", \"version\": \"1.161.12\"}]}, {\"product\": \"eslint-plugin-start\", \"vendor\": \"@tanstack\", \"versions\": [{\"status\": \"affected\", \"version\": \"0.0.4\"}, {\"status\": \"affected\", \"version\": \"0.0.7\"}]}, {\"product\": \"history\", \"vendor\": \"@tanstack\", \"versions\": [{\"status\": \"affected\", \"version\": \"1.161.9\"}, {\"status\": \"affected\", \"version\": \"1.161.12\"}]}, {\"product\": \"nitro-v2-vite-plugin\", \"vendor\": \"@tanstack\", \"versions\": [{\"status\": \"affected\", \"version\": \"1.154.12\"}, {\"status\": \"affected\", \"version\": \"1.154.15\"}]}, {\"product\": \"react-router\", \"vendor\": \"@tanstack\", \"versions\": [{\"status\": \"affected\", \"version\": \"1.169.5\"}, {\"status\": \"affected\", \"version\": \"1.169.8\"}]}, {\"product\": \"react-router-devtools\", \"vendor\": \"@tanstack\", \"versions\": [{\"status\": \"affected\", \"version\": \"1.166.16\"}, {\"status\": \"affected\", \"version\": \"1.166.19\"}]}, {\"product\": \"react-router-ssr-query\", \"vendor\": \"@tanstack\", \"versions\": [{\"status\": \"affected\", \"version\": \"1.166.15\"}, {\"status\": \"affected\", \"version\": \"1.166.18\"}]}, {\"product\": \"react-start\", \"vendor\": \"@tanstack\", \"versions\": [{\"status\": \"affected\", \"version\": \"1.167.68\"}, {\"status\": \"affected\", \"version\": \"1.167.71\"}]}, {\"product\": \"react-start-client\", \"vendor\": \"@tanstack\", \"versions\": [{\"status\": \"affected\", \"version\": \"1.166.51\"}, {\"status\": \"affected\", \"version\": \"1.166.54\"}]}, {\"product\": \"react-start-rsc\", \"vendor\": \"@tanstack\", \"versions\": [{\"status\": \"affected\", \"version\": \"0.0.47\"}, {\"status\": \"affected\", \"version\": \"0.0.50\"}]}, {\"product\": \"react-start-server\", \"vendor\": \"@tanstack\", \"versions\": [{\"status\": \"affected\", \"version\": \"1.166.55\"}, {\"status\": \"affected\", \"version\": \"1.166.58\"}]}, {\"product\": \"router-cli\", \"vendor\": \"@tanstack\", \"versions\": [{\"status\": \"affected\", \"version\": \"1.166.46\"}, {\"status\": \"affected\", \"version\": \"1.166.49\"}]}, {\"product\": \"router-core\", \"vendor\": \"@tanstack\", \"versions\": [{\"status\": \"affected\", \"version\": \"1.169.5\"}, {\"status\": \"affected\", \"version\": \"1.169.8\"}]}, {\"product\": \"router-devtools\", \"vendor\": \"@tanstack\", \"versions\": [{\"status\": \"affected\", \"version\": \"1.166.16\"}, {\"status\": \"affected\", \"version\": \"1.166.19\"}]}, {\"product\": \"router-devtools-core\", \"vendor\": \"@tanstack\", \"versions\": [{\"status\": \"affected\", \"version\": \"1.167.6\"}, {\"status\": \"affected\", \"version\": \"1.167.9\"}]}, {\"product\": \"router-generator\", \"vendor\": \"@tanstack\", \"versions\": [{\"status\": \"affected\", \"version\": \"1.166.45\"}, {\"status\": \"affected\", \"version\": \"1.166.48\"}]}, {\"product\": \"router-plugin\", \"vendor\": \"@tanstack\", \"versions\": [{\"status\": \"affected\", \"version\": \"1.167.38\"}, {\"status\": \"affected\", \"version\": \"1.167.41\"}]}, {\"product\": \"router-ssr-query-core\", \"vendor\": \"@tanstack\", \"versions\": [{\"status\": \"affected\", \"version\": \"1.168.3\"}, {\"status\": \"affected\", \"version\": \"1.168.6\"}]}, {\"product\": \"router-utils\", \"vendor\": \"@tanstack\", \"versions\": [{\"status\": \"affected\", \"version\": \"1.161.11\"}, {\"status\": \"affected\", \"version\": \"1.161.14\"}]}, {\"product\": \"outer-vite-plugin\", \"vendor\": \"@tanstack\", \"versions\": [{\"status\": \"affected\", \"version\": \"1.166.53\"}, {\"status\": \"affected\", \"version\": \"1.166.56\"}]}, {\"product\": \"solid-router\", \"vendor\": \"@tanstack\", \"versions\": [{\"status\": \"affected\", \"version\": \"1.169.5\"}, {\"status\": \"affected\", \"version\": \"1.169.8\"}]}, {\"product\": \"solid-router-devtools\", \"vendor\": \"@tanstack\", \"versions\": [{\"status\": \"affected\", \"version\": \"1.166.16\"}, {\"status\": \"affected\", \"version\": \"1.166.19\"}]}, {\"product\": \"solid-router-ssr-query\", \"vendor\": \"@tanstack\", \"versions\": [{\"status\": \"affected\", \"version\": \"1.166.15\"}, {\"status\": \"affected\", \"version\": \"1.166.18\"}]}, {\"product\": \"solid-start\", \"vendor\": \"@tanstack\", \"versions\": [{\"status\": \"affected\", \"version\": \"1.167.65\"}, {\"status\": \"affected\", \"version\": \"1.167.68\"}]}, {\"product\": \"solid-start-client\", \"vendor\": \"@tanstack\", \"versions\": [{\"status\": \"affected\", \"version\": \"1.166.50\"}, {\"status\": \"affected\", \"version\": \"1.166.53\"}]}, {\"product\": \"solid-start-server\", \"vendor\": \"@tanstack\", \"versions\": [{\"status\": \"affected\", \"version\": \"1.166.54\"}, {\"status\": \"affected\", \"version\": \"1.166.57\"}]}, {\"product\": \"start-client-core\", \"vendor\": \"@tanstack\", \"versions\": [{\"status\": \"affected\", \"version\": \"1.168.5\"}, {\"status\": \"affected\", \"version\": \"1.168.8\"}]}, {\"product\": \"start-fn-stubs\", \"vendor\": \"@tanstack\", \"versions\": [{\"status\": \"affected\", \"version\": \"1.161.9\"}, {\"status\": \"affected\", \"version\": \"1.161.12\"}]}, {\"product\": \"start-plugin-core\", \"vendor\": \"@tanstack\", \"versions\": [{\"status\": \"affected\", \"version\": \"1.169.23\"}, {\"status\": \"affected\", \"version\": \"1.169.26\"}]}, {\"product\": \"start-server-core\", \"vendor\": \"@tanstack\", \"versions\": [{\"status\": \"affected\", \"version\": \"1.167.33\"}, {\"status\": \"affected\", \"version\": \"1.167.36\"}]}, {\"product\": \"start-static-server-functions\", \"vendor\": \"@tanstack\", \"versions\": [{\"status\": \"affected\", \"version\": \"1.166.44\"}, {\"status\": \"affected\", \"version\": \"1.166.47\"}]}, {\"product\": \"start-storage-context\", \"vendor\": \"@tanstack\", \"versions\": [{\"status\": \"affected\", \"version\": \"1.166.38\"}, {\"status\": \"affected\", \"version\": \"1.166.41\"}]}, {\"product\": \"valibot-adapter\", \"vendor\": \"@tanstack\", \"versions\": [{\"status\": \"affected\", \"version\": \"1.166.12\"}, {\"status\": \"affected\", \"version\": \"1.166.15\"}]}, {\"product\": \"virtual-file-routes\", \"vendor\": \"@tanstack\", \"versions\": [{\"status\": \"affected\", \"version\": \"1.161.10\"}, {\"status\": \"affected\", \"version\": \"1.161.13\"}]}, {\"product\": \"vue-router\", \"vendor\": \"@tanstack\", \"versions\": [{\"status\": \"affected\", \"version\": \"1.169.5\"}, {\"status\": \"affected\", \"version\": \"1.169.8\"}]}, {\"product\": \"vue-router-devtools\", \"vendor\": \"@tanstack\", \"versions\": [{\"status\": \"affected\", \"version\": \"1.166.16\"}, {\"status\": \"affected\", \"version\": \"1.166.19\"}]}, {\"product\": \"vue-router-ssr-query\", \"vendor\": \"@tanstack\", \"versions\": [{\"status\": \"affected\", \"version\": \"1.166.15\"}, {\"status\": \"affected\", \"version\": \"1.166.18\"}]}, {\"product\": \"vue-start\", \"vendor\": \"@tanstack\", \"versions\": [{\"status\": \"affected\", \"version\": \"1.167.61\"}, {\"status\": \"affected\", \"version\": \"1.167.64\"}]}, {\"product\": \"vue-start-client\", \"vendor\": \"@tanstack\", \"versions\": [{\"status\": \"affected\", \"version\": \"1.166.46\"}, {\"status\": \"affected\", \"version\": \"1.166.49\"}]}, {\"product\": \"vue-start-server\", \"vendor\": \"@tanstack\", \"versions\": [{\"status\": \"affected\", \"version\": \"1.166.50\"}, {\"status\": \"affected\", \"version\": \"1.166.53\"}]}, {\"product\": \"zod-adapter\", \"vendor\": \"@tanstack\", \"versions\": [{\"status\": \"affected\", \"version\": \"1.166.12\"}, {\"status\": \"affected\", \"version\": \"1.166.15\"}]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for TanStack/router, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes \\u2014 a pull_request_target \\\"Pwn Request\\\" misconfiguration, GitHub Actions cache poisoning across the fork\\u2194base trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process \\u2014 to publish credential-stealing malware under a trusted identity. Each affected package received exactly two malicious versions, published a few minutes apart.\"}], \"metrics\": [{\"cvssV3_1\": {\"attackComplexity\": \"LOW\", \"attackVector\": \"NETWORK\", \"availabilityImpact\": \"HIGH\", \"baseScore\": 9.6, \"baseSeverity\": \"CRITICAL\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"scope\": \"CHANGED\", \"userInteraction\": \"REQUIRED\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H\", \"version\": \"3.1\"}}], \"problemTypes\": [{\"descriptions\": [{\"cweId\": \"CWE-506\", \"description\": \"CWE-506: Embedded Malicious Code\", \"lang\": \"en\", \"type\": \"CWE\"}]}], \"providerMetadata\": {\"dateUpdated\": \"2026-05-12T15:16:17.354Z\", \"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\"}, \"references\": [{\"name\": \"https://github.com/TanStack/router/security/advisories/GHSA-g7cv-rxg3-hmpx\", \"tags\": [\"x_refsource_CONFIRM\"], \"url\": \"https://github.com/TanStack/router/security/advisories/GHSA-g7cv-rxg3-hmpx\"}, {\"name\": \"https://github.com/TanStack/router/issues/7383\", \"tags\": [\"x_refsource_MISC\"], \"url\": \"https://github.com/TanStack/router/issues/7383\"}, {\"name\": \"https://tanstack.com/blog/npm-supply-chain-compromise-postmortem\", \"tags\": [\"x_refsource_MISC\"], \"url\": \"https://tanstack.com/blog/npm-supply-chain-compromise-postmortem\"}, {\"name\": \"https://www.stepsecurity.io/blog/mini-shai-hulud-is-back-a-self-spreading-supply-chain-attack-hits-the-npm-ecosystem\", \"tags\": [\"x_refsource_MISC\"], \"url\": \"https://www.stepsecurity.io/blog/mini-shai-hulud-is-back-a-self-spreading-supply-chain-attack-hits-the-npm-ecosystem\"}], \"source\": {\"advisory\": \"GHSA-g7cv-rxg3-hmpx\", \"discovery\": \"UNKNOWN\"}, \"title\": \"Malware in 42 @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys\"}}, \"cveMetadata\": {\"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"assignerShortName\": \"GitHub_M\", \"cveId\": \"CVE-2026-45321\", \"datePublished\": \"2026-05-12T00:12:35.452Z\", \"dateReserved\": \"2026-05-11T20:50:30.539Z\", \"dateUpdated\": \"2026-08-04T03:56:09.005Z\", \"state\": \"PUBLISHED\"}, \"dataType\": \"CVE_RECORD\", \"dataVersion\": \"5.2\"}"},{"alert":0,"cve":"CVE-2026-45321","id":3593,"kind":"epss","observed_at":1793665375,"payload":"{\"date\": \"2026-11-02\", \"epss\": 0.03278, \"percentile\": 0.88427}"},{"alert":1,"cve":"CVE-2026-45321","id":162,"kind":"kev","observed_at":1793665375,"payload":"{\"cveID\": \"CVE-2026-45321\", \"cwes\": [], \"dateAdded\": \"2026-05-27\", \"dueDate\": \"2026-06-10\", \"forensicTriage\": \"No\", \"knownRansomwareCampaignUse\": \"Known\", \"notes\": \"This vulnerability could affect an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://github.com/TanStack/router/security/advisories/GHSA-g7cv-rxg3-hmpx ; https://nvd.nist.gov/vuln/detail/CVE-2026-45321\", \"product\": \"TanStack\", \"requiredAction\": \"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.\", \"shortDescription\": \"TanStack contains an unspecified vulnerability that allowed malicious versions of the product to be published to the npm registry to publish credential-stealing malware under a trusted identity.\", \"vendorProject\": \"TanStack\", \"vulnerabilityName\": \"TanStack Unspecified Vulnerability\"}"}],"record":{"affected":[{"product":"arktype-adapter","vendor":"@tanstack","versions":[{"status":"affected","version":"1.166.12"},{"status":"affected","version":"1.166.15"}]},{"product":"eslint-plugin-router","vendor":"@tanstack","versions":[{"status":"affected","version":"1.161.9"},{"status":"affected","version":"1.161.12"}]},{"product":"eslint-plugin-start","vendor":"@tanstack","versions":[{"status":"affected","version":"0.0.4"},{"status":"affected","version":"0.0.7"}]},{"product":"history","vendor":"@tanstack","versions":[{"status":"affected","version":"1.161.9"},{"status":"affected","version":"1.161.12"}]},{"product":"nitro-v2-vite-plugin","vendor":"@tanstack","versions":[{"status":"affected","version":"1.154.12"},{"status":"affected","version":"1.154.15"}]},{"product":"react-router","vendor":"@tanstack","versions":[{"status":"affected","version":"1.169.5"},{"status":"affected","version":"1.169.8"}]},{"product":"react-router-devtools","vendor":"@tanstack","versions":[{"status":"affected","version":"1.166.16"},{"status":"affected","version":"1.166.19"}]},{"product":"react-router-ssr-query","vendor":"@tanstack","versions":[{"status":"affected","version":"1.166.15"},{"status":"affected","version":"1.166.18"}]},{"product":"react-start","vendor":"@tanstack","versions":[{"status":"affected","version":"1.167.68"},{"status":"affected","version":"1.167.71"}]},{"product":"react-start-client","vendor":"@tanstack","versions":[{"status":"affected","version":"1.166.51"},{"status":"affected","version":"1.166.54"}]},{"product":"react-start-rsc","vendor":"@tanstack","versions":[{"status":"affected","version":"0.0.47"},{"status":"affected","version":"0.0.50"}]},{"product":"react-start-server","vendor":"@tanstack","versions":[{"status":"affected","version":"1.166.55"},{"status":"affected","version":"1.166.58"}]},{"product":"router-cli","vendor":"@tanstack","versions":[{"status":"affected","version":"1.166.46"},{"status":"affected","version":"1.166.49"}]},{"product":"router-core","vendor":"@tanstack","versions":[{"status":"affected","version":"1.169.5"},{"status":"affected","version":"1.169.8"}]},{"product":"router-devtools","vendor":"@tanstack","versions":[{"status":"affected","version":"1.166.16"},{"status":"affected","version":"1.166.19"}]},{"product":"router-devtools-core","vendor":"@tanstack","versions":[{"status":"affected","version":"1.167.6"},{"status":"affected","version":"1.167.9"}]},{"product":"router-generator","vendor":"@tanstack","versions":[{"status":"affected","version":"1.166.45"},{"status":"affected","version":"1.166.48"}]},{"product":"router-plugin","vendor":"@tanstack","versions":[{"status":"affected","version":"1.167.38"},{"status":"affected","version":"1.167.41"}]},{"product":"router-ssr-query-core","vendor":"@tanstack","versions":[{"status":"affected","version":"1.168.3"},{"status":"affected","version":"1.168.6"}]},{"product":"router-utils","vendor":"@tanstack","versions":[{"status":"affected","version":"1.161.11"},{"status":"affected","version":"1.161.14"}]},{"product":"outer-vite-plugin","vendor":"@tanstack","versions":[{"status":"affected","version":"1.166.53"},{"status":"affected","version":"1.166.56"}]},{"product":"solid-router","vendor":"@tanstack","versions":[{"status":"affected","version":"1.169.5"},{"status":"affected","version":"1.169.8"}]},{"product":"solid-router-devtools","vendor":"@tanstack","versions":[{"status":"affected","version":"1.166.16"},{"status":"affected","version":"1.166.19"}]},{"product":"solid-router-ssr-query","vendor":"@tanstack","versions":[{"status":"affected","version":"1.166.15"},{"status":"affected","version":"1.166.18"}]},{"product":"solid-start","vendor":"@tanstack","versions":[{"status":"affected","version":"1.167.65"},{"status":"affected","version":"1.167.68"}]},{"product":"solid-start-client","vendor":"@tanstack","versions":[{"status":"affected","version":"1.166.50"},{"status":"affected","version":"1.166.53"}]},{"product":"solid-start-server","vendor":"@tanstack","versions":[{"status":"affected","version":"1.166.54"},{"status":"affected","version":"1.166.57"}]},{"product":"start-client-core","vendor":"@tanstack","versions":[{"status":"affected","version":"1.168.5"},{"status":"affected","version":"1.168.8"}]},{"product":"start-fn-stubs","vendor":"@tanstack","versions":[{"status":"affected","version":"1.161.9"},{"status":"affected","version":"1.161.12"}]},{"product":"start-plugin-core","vendor":"@tanstack","versions":[{"status":"affected","version":"1.169.23"},{"status":"affected","version":"1.169.26"}]},{"product":"start-server-core","vendor":"@tanstack","versions":[{"status":"affected","version":"1.167.33"},{"status":"affected","version":"1.167.36"}]},{"product":"start-static-server-functions","vendor":"@tanstack","versions":[{"status":"affected","version":"1.166.44"},{"status":"affected","version":"1.166.47"}]},{"product":"start-storage-context","vendor":"@tanstack","versions":[{"status":"affected","version":"1.166.38"},{"status":"affected","version":"1.166.41"}]},{"product":"valibot-adapter","vendor":"@tanstack","versions":[{"status":"affected","version":"1.166.12"},{"status":"affected","version":"1.166.15"}]},{"product":"virtual-file-routes","vendor":"@tanstack","versions":[{"status":"affected","version":"1.161.10"},{"status":"affected","version":"1.161.13"}]},{"product":"vue-router","vendor":"@tanstack","versions":[{"status":"affected","version":"1.169.5"},{"status":"affected","version":"1.169.8"}]},{"product":"vue-router-devtools","vendor":"@tanstack","versions":[{"status":"affected","version":"1.166.16"},{"status":"affected","version":"1.166.19"}]},{"product":"vue-router-ssr-query","vendor":"@tanstack","versions":[{"status":"affected","version":"1.166.15"},{"status":"affected","version":"1.166.18"}]},{"product":"vue-start","vendor":"@tanstack","versions":[{"status":"affected","version":"1.167.61"},{"status":"affected","version":"1.167.64"}]},{"product":"vue-start-client","vendor":"@tanstack","versions":[{"status":"affected","version":"1.166.46"},{"status":"affected","version":"1.166.49"}]},{"product":"vue-start-server","vendor":"@tanstack","versions":[{"status":"affected","version":"1.166.50"},{"status":"affected","version":"1.166.53"}]},{"product":"zod-adapter","vendor":"@tanstack","versions":[{"status":"affected","version":"1.166.12"},{"status":"affected","version":"1.166.15"}]}],"cna":{"containers":{"adp":[{"metrics":[{"other":{"content":{"id":"CVE-2026-45321","options":[{"Exploitation":"active"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","timestamp":"2026-05-27T00:00:00+00:00","version":"2.0.3"},"type":"ssvc"}},{"other":{"content":{"dateAdded":"2026-05-27","reference":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-45321"},"type":"kev"}}],"providerMetadata":{"dateUpdated":"2026-08-04T03:56:09.005Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"references":[{"tags":["government-resource"],"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-45321"}],"timeline":[{"lang":"en","time":"2026-05-27T00:00:00.000Z","value":"CVE-2026-45321 added to CISA KEV"}],"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"product":"arktype-adapter","vendor":"@tanstack","versions":[{"status":"affected","version":"1.166.12"},{"status":"affected","version":"1.166.15"}]},{"product":"eslint-plugin-router","vendor":"@tanstack","versions":[{"status":"affected","version":"1.161.9"},{"status":"affected","version":"1.161.12"}]},{"product":"eslint-plugin-start","vendor":"@tanstack","versions":[{"status":"affected","version":"0.0.4"},{"status":"affected","version":"0.0.7"}]},{"product":"history","vendor":"@tanstack","versions":[{"status":"affected","version":"1.161.9"},{"status":"affected","version":"1.161.12"}]},{"product":"nitro-v2-vite-plugin","vendor":"@tanstack","versions":[{"status":"affected","version":"1.154.12"},{"status":"affected","version":"1.154.15"}]},{"product":"react-router","vendor":"@tanstack","versions":[{"status":"affected","version":"1.169.5"},{"status":"affected","version":"1.169.8"}]},{"product":"react-router-devtools","vendor":"@tanstack","versions":[{"status":"affected","version":"1.166.16"},{"status":"affected","version":"1.166.19"}]},{"product":"react-router-ssr-query","vendor":"@tanstack","versions":[{"status":"affected","version":"1.166.15"},{"status":"affected","version":"1.166.18"}]},{"product":"react-start","vendor":"@tanstack","versions":[{"status":"affected","version":"1.167.68"},{"status":"affected","version":"1.167.71"}]},{"product":"react-start-client","vendor":"@tanstack","versions":[{"status":"affected","version":"1.166.51"},{"status":"affected","version":"1.166.54"}]},{"product":"react-start-rsc","vendor":"@tanstack","versions":[{"status":"affected","version":"0.0.47"},{"status":"affected","version":"0.0.50"}]},{"product":"react-start-server","vendor":"@tanstack","versions":[{"status":"affected","version":"1.166.55"},{"status":"affected","version":"1.166.58"}]},{"product":"router-cli","vendor":"@tanstack","versions":[{"status":"affected","version":"1.166.46"},{"status":"affected","version":"1.166.49"}]},{"product":"router-core","vendor":"@tanstack","versions":[{"status":"affected","version":"1.169.5"},{"status":"affected","version":"1.169.8"}]},{"product":"router-devtools","vendor":"@tanstack","versions":[{"status":"affected","version":"1.166.16"},{"status":"affected","version":"1.166.19"}]},{"product":"router-devtools-core","vendor":"@tanstack","versions":[{"status":"affected","version":"1.167.6"},{"status":"affected","version":"1.167.9"}]},{"product":"router-generator","vendor":"@tanstack","versions":[{"status":"affected","version":"1.166.45"},{"status":"affected","version":"1.166.48"}]},{"product":"router-plugin","vendor":"@tanstack","versions":[{"status":"affected","version":"1.167.38"},{"status":"affected","version":"1.167.41"}]},{"product":"router-ssr-query-core","vendor":"@tanstack","versions":[{"status":"affected","version":"1.168.3"},{"status":"affected","version":"1.168.6"}]},{"product":"router-utils","vendor":"@tanstack","versions":[{"status":"affected","version":"1.161.11"},{"status":"affected","version":"1.161.14"}]},{"product":"outer-vite-plugin","vendor":"@tanstack","versions":[{"status":"affected","version":"1.166.53"},{"status":"affected","version":"1.166.56"}]},{"product":"solid-router","vendor":"@tanstack","versions":[{"status":"affected","version":"1.169.5"},{"status":"affected","version":"1.169.8"}]},{"product":"solid-router-devtools","vendor":"@tanstack","versions":[{"status":"affected","version":"1.166.16"},{"status":"affected","version":"1.166.19"}]},{"product":"solid-router-ssr-query","vendor":"@tanstack","versions":[{"status":"affected","version":"1.166.15"},{"status":"affected","version":"1.166.18"}]},{"product":"solid-start","vendor":"@tanstack","versions":[{"status":"affected","version":"1.167.65"},{"status":"affected","version":"1.167.68"}]},{"product":"solid-start-client","vendor":"@tanstack","versions":[{"status":"affected","version":"1.166.50"},{"status":"affected","version":"1.166.53"}]},{"product":"solid-start-server","vendor":"@tanstack","versions":[{"status":"affected","version":"1.166.54"},{"status":"affected","version":"1.166.57"}]},{"product":"start-client-core","vendor":"@tanstack","versions":[{"status":"affected","version":"1.168.5"},{"status":"affected","version":"1.168.8"}]},{"product":"start-fn-stubs","vendor":"@tanstack","versions":[{"status":"affected","version":"1.161.9"},{"status":"affected","version":"1.161.12"}]},{"product":"start-plugin-core","vendor":"@tanstack","versions":[{"status":"affected","version":"1.169.23"},{"status":"affected","version":"1.169.26"}]},{"product":"start-server-core","vendor":"@tanstack","versions":[{"status":"affected","version":"1.167.33"},{"status":"affected","version":"1.167.36"}]},{"product":"start-static-server-functions","vendor":"@tanstack","versions":[{"status":"affected","version":"1.166.44"},{"status":"affected","version":"1.166.47"}]},{"product":"start-storage-context","vendor":"@tanstack","versions":[{"status":"affected","version":"1.166.38"},{"status":"affected","version":"1.166.41"}]},{"product":"valibot-adapter","vendor":"@tanstack","versions":[{"status":"affected","version":"1.166.12"},{"status":"affected","version":"1.166.15"}]},{"product":"virtual-file-routes","vendor":"@tanstack","versions":[{"status":"affected","version":"1.161.10"},{"status":"affected","version":"1.161.13"}]},{"product":"vue-router","vendor":"@tanstack","versions":[{"status":"affected","version":"1.169.5"},{"status":"affected","version":"1.169.8"}]},{"product":"vue-router-devtools","vendor":"@tanstack","versions":[{"status":"affected","version":"1.166.16"},{"status":"affected","version":"1.166.19"}]},{"product":"vue-router-ssr-query","vendor":"@tanstack","versions":[{"status":"affected","version":"1.166.15"},{"status":"affected","version":"1.166.18"}]},{"product":"vue-start","vendor":"@tanstack","versions":[{"status":"affected","version":"1.167.61"},{"status":"affected","version":"1.167.64"}]},{"product":"vue-start-client","vendor":"@tanstack","versions":[{"status":"affected","version":"1.166.46"},{"status":"affected","version":"1.166.49"}]},{"product":"vue-start-server","vendor":"@tanstack","versions":[{"status":"affected","version":"1.166.50"},{"status":"affected","version":"1.166.53"}]},{"product":"zod-adapter","vendor":"@tanstack","versions":[{"status":"affected","version":"1.166.12"},{"status":"affected","version":"1.166.15"}]}],"descriptions":[{"lang":"en","value":"On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for TanStack/router, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes \u2014 a pull_request_target \"Pwn Request\" misconfiguration, GitHub Actions cache poisoning across the fork\u2194base trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process \u2014 to publish credential-stealing malware under a trusted identity. Each affected package received exactly two malicious versions, published a few minutes apart."}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.6,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","version":"3.1"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-506","description":"CWE-506: Embedded Malicious Code","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-05-12T15:16:17.354Z","orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M"},"references":[{"name":"https://github.com/TanStack/router/security/advisories/GHSA-g7cv-rxg3-hmpx","tags":["x_refsource_CONFIRM"],"url":"https://github.com/TanStack/router/security/advisories/GHSA-g7cv-rxg3-hmpx"},{"name":"https://github.com/TanStack/router/issues/7383","tags":["x_refsource_MISC"],"url":"https://github.com/TanStack/router/issues/7383"},{"name":"https://tanstack.com/blog/npm-supply-chain-compromise-postmortem","tags":["x_refsource_MISC"],"url":"https://tanstack.com/blog/npm-supply-chain-compromise-postmortem"},{"name":"https://www.stepsecurity.io/blog/mini-shai-hulud-is-back-a-self-spreading-supply-chain-attack-hits-the-npm-ecosystem","tags":["x_refsource_MISC"],"url":"https://www.stepsecurity.io/blog/mini-shai-hulud-is-back-a-self-spreading-supply-chain-attack-hits-the-npm-ecosystem"}],"source":{"advisory":"GHSA-g7cv-rxg3-hmpx","discovery":"UNKNOWN"},"title":"Malware in 42 @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys"}},"cveMetadata":{"assignerOrgId":"a0819718-46f1-4df5-94e2-005712e83aaa","assignerShortName":"GitHub_M","cveId":"CVE-2026-45321","datePublished":"2026-05-12T00:12:35.452Z","dateReserved":"2026-05-11T20:50:30.539Z","dateUpdated":"2026-08-04T03:56:09.005Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"cna_checked":1794111601,"cve":"CVE-2026-45321","description":"On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for TanStack/router, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes \u2014 a pull_request_target \"Pwn Request\" misconfiguration, GitHub Actions cache poisoning across the fork\u2194base trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process \u2014 to publish credential-stealing malware under a trusted identity. Each affected package received exactly two malicious versions, published a few minutes apart.","epss":{"date":"2026-11-12","epss":0.03278,"percentile":0.88603},"epss_checked":1794522003,"first_seen":1793665375,"kev":{"cveID":"CVE-2026-45321","cwes":[],"dateAdded":"2026-05-27","dueDate":"2026-06-10","forensicTriage":"No","knownRansomwareCampaignUse":"Known","notes":"This vulnerability could affect an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://github.com/TanStack/router/security/advisories/GHSA-g7cv-rxg3-hmpx ; https://nvd.nist.gov/vuln/detail/CVE-2026-45321","product":"TanStack","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","shortDescription":"TanStack contains an unspecified vulnerability that allowed malicious versions of the product to be published to the npm registry to publish credential-stealing malware under a trusted identity.","vendorProject":"TanStack","vulnerabilityName":"TanStack Unspecified Vulnerability"},"kev_checked":1794522003,"products":"@tanstack arktype-adapter, @tanstack eslint-plugin-router, @tanstack eslint-plugin-start, @tanstack history, @tanstack nitro-v2-vite-plugin, @tanstack react-router, @tanstack react-router-devtools, @tanstack react-router-ssr-query, @tanstack react-start, @tanstack react-start-client, @tanstack react-start-rsc, @tanstack react-start-server, @tanstack router-cli, @tanstack router-core, @tanstack router-devtools, @tanstack router-devtools-core, @tanstack router-generator, @tanstack router-plugin, @tanstack router-ssr-query-core, @tanstack router-utils, @tanstack outer-vite-plugin, @tanstack solid-router, @tanstack solid-router-devtools, @tanstack solid-router-ssr-query, @tanstack solid-start, @tanstack solid-start-client, @tanstack solid-start-server, @tanstack start-client-core, @tanstack start-fn-stubs, @tanstack start-plugin-core, @tanstack start-server-core, @tanstack start-static-server-functions, @tanstack start-storage-context, @tanstack valibot-adapter, @tanstack virtual-file-routes, @tanstack vue-router, @tanstack vue-router-devtools, @tanstack vue-router-ssr-query, @tanstack vue-start, @tanstack vue-start-client, @tanstack vue-start-server, @tanstack zod-adapter","references":["https://github.com/TanStack/router/security/advisories/GHSA-g7cv-rxg3-hmpx","https://github.com/TanStack/router/issues/7383","https://tanstack.com/blog/npm-supply-chain-compromise-postmortem","https://www.stepsecurity.io/blog/mini-shai-hulud-is-back-a-self-spreading-supply-chain-attack-hits-the-npm-ecosystem","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-45321"],"score":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.6,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","provider":"GitHub_M","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","version":"3.1"},"solutions":"","state":"PUBLISHED","title":"Malware in 42 @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys","updated_at":1794500401,"workarounds":""},"sources":[]}