CSIRTS // UNIFIED SECURITY ADVISORY FEEDSYS ● ONLINE · POWERED BY INTELFUSIONS.COM

← Back to feed

CVE-2026-45321: TanStack Unspecified Vulnerability

criticalknown exploitedpublic exploitCVE-2026-45321
Actively exploited. At least one CVE in this advisory is listed in the CISA Known Exploited Vulnerabilities catalog — exploitation has been observed in the wild. Treat remediation as urgent.
TanStack contains an unspecified vulnerability that allowed malicious versions of the product to be published to the npm registry to publish credential-stealing malware under a trusted identity.

CSIRTS triage

vendor: TanStackproduct: TanStackSupply chain
What
TanStack contains an unspecified vulnerability that allowed malicious versions of the product to be published to the npm registry to publish credential-stealing malware under a trusted identity.
Who is affected
Users of TanStack who may have installed malicious versions from the npm registry.
Urgency
Remediation is urgent due to the exploitation status and the critical nature of the vulnerability.
Action
Users should remove any untrusted versions and monitor for updates from TanStack.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch TanStack

Get an email when a new TanStack advisory drops — max one per day, one-click unsubscribe.

Details

Source
CISA Known Exploited Vulnerabilities (US · database · site)
Severity
critical
Published
2026-05-27
Exploitation
Observed in the wild (CISA KEV)

Original advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-45321

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Referenced CVEs

CVECSIRTS overviewExternal
CVE-2026-45321coverage & exploitation statusNVD · CVE.org

More from CISA Known Exploited Vulnerabilities