{"action":"Upgrade @tanstack/vue-start to 1.168.56 or later.","affected":[{"fixed":"1.168.56","introduced":"1.143.12"}],"component":"@tanstack/vue-start","cve_ids":["CVE-2026-102989"],"ecosystem":"npm","epss":0.00544,"exploited":false,"fixed_versions":["1.168.56"],"ghsa_id":"GHSA-qx66-fv34-fjm8","id":"tcs_01M5KG7EVHS1GGWABN632S3P61","modified_at":"2026-10-15T20:30:04.544571974Z","published_at":"2026-10-15T20:22:20Z","references":["https://osv.dev/vulnerability/GHSA-qx66-fv34-fjm8","https://github.com/TanStack/router/security/advisories/GHSA-qx66-fv34-fjm8","https://nvd.nist.gov/vuln/detail/CVE-2026-102989","https://github.com/TanStack/router/pull/8573","https://github.com/TanStack/router/commit/d521abd71c69f1ff010bb3def4d417cb5fa058cb","https://github.com/TanStack/router","https://github.com/TanStack/router/releases/tag/release-2026-09-30-1747"],"severity":{"label":"critical","score":9.3},"sources":[{"source":"osv","source_id":"GHSA-qx66-fv34-fjm8#npm/@tanstack/vue-start","url":"https://osv.dev/vulnerability/GHSA-qx66-fv34-fjm8"}],"summary":"TanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responses"}