CVE-2026-45321: @tanstack arktype-adapter, верига на доставки

9.6

CVSS 3.1

Няма данни

Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)

Да

Атакува се

в каталога KEV от 27 май 2026

Атакува се в момента

15 дни

Време до експлоатация

след публикуването

Атакува се по мрежата, без особени условия, без вход и след действие от потребителя.

CVE радар: още уязвимости от този вид

Използва се в рансъмуер атаки
Експлоатация: активно се експлоатира
Атаката не може да се автоматизира

Описание

Оригинално описание

On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for TanStack/router, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes — a pull_request_target "Pwn Request" misconfiguration, GitHub Actions cache poisoning across the fork↔base trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process — to publish credential-stealing malware under a trusted identity. Each affected package received exactly two malicious versions, published a few minutes apart.

Засегнати продукти

@tanstack arktype-adapter: 1.166.12; 1.166.15
@tanstack eslint-plugin-router: 1.161.9; 1.161.12
@tanstack eslint-plugin-start: 0.0.4; 0.0.7
@tanstack history: 1.161.9; 1.161.12
@tanstack nitro-v2-vite-plugin: 1.154.12; 1.154.15
@tanstack react-router: 1.169.5; 1.169.8
@tanstack react-router-devtools: 1.166.16; 1.166.19
@tanstack react-router-ssr-query: 1.166.15; 1.166.18
@tanstack react-start: 1.167.68; 1.167.71
@tanstack react-start-client: 1.166.51; 1.166.54
@tanstack react-start-rsc: 0.0.47; 0.0.50
@tanstack react-start-server: 1.166.55; 1.166.58
@tanstack router-cli: 1.166.46; 1.166.49
@tanstack router-core: 1.169.5; 1.169.8
@tanstack router-devtools: 1.166.16; 1.166.19
@tanstack router-devtools-core: 1.167.6; 1.167.9
@tanstack router-generator: 1.166.45; 1.166.48
@tanstack router-plugin: 1.167.38; 1.167.41
@tanstack router-ssr-query-core: 1.168.3; 1.168.6
@tanstack router-utils: 1.161.11; 1.161.14
@tanstack outer-vite-plugin: 1.166.53; 1.166.56
@tanstack solid-router: 1.169.5; 1.169.8
@tanstack solid-router-devtools: 1.166.16; 1.166.19
@tanstack solid-router-ssr-query: 1.166.15; 1.166.18
@tanstack solid-start: 1.167.65; 1.167.68
@tanstack solid-start-client: 1.166.50; 1.166.53
@tanstack solid-start-server: 1.166.54; 1.166.57
@tanstack start-client-core: 1.168.5; 1.168.8
@tanstack start-fn-stubs: 1.161.9; 1.161.12
@tanstack start-plugin-core: 1.169.23; 1.169.26
@tanstack start-server-core: 1.167.33; 1.167.36
@tanstack start-static-server-functions: 1.166.44; 1.166.47
@tanstack start-storage-context: 1.166.38; 1.166.41
@tanstack valibot-adapter: 1.166.12; 1.166.15
@tanstack virtual-file-routes: 1.161.10; 1.161.13
@tanstack vue-router: 1.169.5; 1.169.8
@tanstack vue-router-devtools: 1.166.16; 1.166.19
@tanstack vue-router-ssr-query: 1.166.15; 1.166.18
@tanstack vue-start: 1.167.61; 1.167.64
@tanstack vue-start-client: 1.166.46; 1.166.49
@tanstack vue-start-server: 1.166.50; 1.166.53
@tanstack zod-adapter: 1.166.12; 1.166.15

Вид слабост

CWE-506 Вграден злонамерен код

История

12 май 2026 Публикувано

Други уязвимости в @tanstack arktype-adapter

9.3CVE-2026-102989

Описание

Засегнати продукти

Вид слабост

История

Други уязвимости в @tanstack arktype-adapter

Първоизточници