CVE-2026-45321: TanStack Unspecified Vulnerability

Is it exploited?

Yes. CISA added it to the Known Exploited Vulnerabilities catalog on 27 May 2026, 15 days after the CVE record was published.

How likely is exploitation in the next 30 days?

3.3%

EPSS score, percentile 88.4 of all scored records

How severe?

9.6 Critical

CVSS v3.1 base score, given by the CNA

What should I do?

Required action (CISA), due 10 Jun 2026: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

The CVE record links no vendor advisory, patch or mitigation.

Which versions are affected?

Affected: 1.166.12; 1.166.15; 1.161.9; 1.161.12; 0.0.4; 0.0.7; 1.161.9; 1.161.12; 1.154.12; 1.154.15; 1.169.5; 1.169.8; 1.166.16; 1.166.19; 1.166.15; 1.166.18; 1.167.68; 1.167.71; 1.166.51; 1.166.54; 0.0.47; 0.0.50; 1.166.55; 1.166.58; 1.166.46; 1.166.49; 1.169.5; 1.169.8; 1.166.16; 1.166.19; 1.167.6; 1.167.9; 1.166.45; 1.166.48; 1.167.38; 1.167.41; 1.168.3; 1.168.6; 1.161.11; 1.161.14

Versions by product

Source: CISA Known Exploited Vulnerabilities (KEV) catalog, 2026.10.28, as of 28 Oct 2026; FIRST Exploit Prediction Scoring System (EPSS), v2026.06.15, as of 28 Oct 2026; CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026. About the data.

What to do

CISA due date for this action: 10 June 2026.

Advisories and patches

The CVE record links no vendor advisory, patch or mitigation.

Linked from CISA's catalog entry

• https://github.com/TanStack/router/security/advisories/GHSA-g7cv-rxg3-hmpx
• https://nvd.nist.gov/vuln/detail/CVE-2026-45321

Affected products and versions

As listed in the CVE record.

Source: CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026. About the data.

About this vulnerability

TanStack contains an unspecified vulnerability that allowed malicious versions of the product to be published to the npm registry to publish credential-stealing malware under a trusted identity.

Summary: CISA's KEV catalog, as of 28 Oct 2026.

• CISA added CVE-2026-45321 to its Known Exploited Vulnerabilities (KEV) catalog on 27 May 2026.
• CISA marks it as known to be used in ransomware campaigns.
• The due date CISA sets for the required action is 10 Jun 2026.
• The CVE record was published on 12 May 2026, 15 days before it was added to KEV.
• The CVE record carries a CVSS v3.1 base score of 9.6 (Critical), given by its CNA.
• FIRST's EPSS model puts the probability of exploitation in the next 30 days at 3.3% (percentile 88.4), as of 28 Oct 2026.
• CISA's SSVC assessment in the CVE record: exploitation active, automatable no, technical impact total.

Source: CISA Known Exploited Vulnerabilities (KEV) catalog, 2026.10.28, as of 28 Oct 2026; CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026; FIRST Exploit Prediction Scoring System (EPSS), v2026.06.15, as of 28 Oct 2026. About the data.

Description

Malware in 42 @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys

On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for TanStack/router, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes — a pull_request_target "Pwn Request" misconfiguration, GitHub Actions cache poisoning across the fork↔base trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process — to publish credential-stealing malware under a trusted identity. Each affected package received exactly two malicious versions, published a few minutes apart.

Source: CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026. About the data.

Weakness

• CWE-506: Embedded Malicious Code

CWE and CAPEC are maintained by MITRE; the entries are those named in the CVE record and the KEV entry.

Timeline

References

• https://github.com/TanStack/router/security/advisories/GHSA-g7cv-rxg3-hmpx
• https://github.com/TanStack/router/issues/7383
• https://tanstack.com/blog/npm-supply-chain-compromise-postmortem
• https://www.stepsecurity.io/blog/mini-shai-hulud-is-back-a-self-spreading-supply-chain-attack-hits-the-npm-ecosystem