What’s Vulnerable › Vulnerabilities

CVE-2026-45321: TanStack Unspecified Vulnerability

• Severity: critical (CVSS 9.6 v3.1)
• Exploited in the wild: yes — in CISA KEV since 2026-05-27
• EPSS: 3.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-05-12 · updated 2026-10-26
• Weakness: CWE-506

Description

On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for TanStack/router, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes — a pull_request_target "Pwn Request" misconfiguration, GitHub Actions cache poisoning across the fork↔base trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process — to publish credential-stealing malware under a trusted identity. Each affected package received exactly two malicious versions, published a few minutes apart.

Affected products

• Abhishake1 Supersurkhet/Cli: 0.0.2, 0.0.3, 0.0.4, 0.0.5, 0.0.6, 0.0.7
• Abhishake1 Supersurkhet/Sdk: 0.0.2, 0.0.3, 0.0.4, 0.0.5, 0.0.6, 0.0.7
• Abhishake1 Taskflow-Corp/Cli: 0.1.24, 0.1.25, 0.1.26, 0.1.27, 0.1.28, 0.1.29
• Agentworkhq Agentwork-Cli: 0.1.4, 0.1.5
• Antoinebcx Ml-Toolkit-Ts: 1.0.4, 1.0.5
• Antoinebcx Ml-Toolkit-Ts/Preprocessing: 1.0.2, 1.0.3
• Antoinebcx Ml-Toolkit-Ts/Xgboost: 1.0.3, 1.0.4
• Beproduct/Nestjs-Auth: 0.1.2, 0.1.3, 0.1.4, 0.1.5, 0.1.6, 0.1.7 (+11)
• Christianalares Git-Git-Git: 1.0.8, 1.0.9, 1.0.10, 1.0.12
• Christianalares Git Branch Selector: 1.3.3, 1.3.4, 1.3.5, 1.3.7
• Christianalares Nextmove-Mcp: 0.1.3, 0.1.4, 0.1.5, 0.1.7
• Christianalares Tolka/Cli: 1.0.2, 1.0.3, 1.0.4, 1.0.6
• Dirigible-Ai/Sdk: 0.6.2, 0.6.3
• guardrails-ai guardrails: 0.10.1
• kilbot Tallyui/Components: 1.0.1, 1.0.2, 1.0.3
• kilbot Tallyui/Connector-Medusa: 1.0.1, 1.0.2, 1.0.3
• kilbot Tallyui/Connector-Shopify: 1.0.1, 1.0.2, 1.0.3
• kilbot Tallyui/Connector-Vendure: 1.0.1, 1.0.2, 1.0.3
• kilbot Tallyui/Connector-Woocommerce: 1.0.1, 1.0.2, 1.0.3
• kilbot Tallyui/Core: 0.2.1, 0.2.2, 0.2.3
• kilbot Tallyui/Database: 1.0.1, 1.0.2, 1.0.3
• kilbot Tallyui/Pos: 0.1.1, 0.1.2, 0.1.3
• kilbot Tallyui/Storage-Sqlite: 0.2.1, 0.2.2, 0.2.3
• kilbot Tallyui/Theme: 0.2.1, 0.2.2, 0.2.3
• Linuxfoundation Opensearch: 3.6.2
• Matheuspergoli Draftauth/Client: 0.2.1, 0.2.2
• Matheuspergoli Draftauth/Core: 0.13.1, 0.13.2
• Matheuspergoli Draftlab/Auth: 0.24.1, 0.24.2
• Matheuspergoli Draftlab/Auth-Router: 0.5.1, 0.5.2
• Matheuspergoli Draftlab/Db: 0.16.1, 0.16.2

References

• https://github.com/TanStack/router/issues/7383
• https://github.com/TanStack/router/security/advisories/GHSA-g7cv-rxg3-hmpx
• https://tanstack.com/blog/npm-supply-chain-compromise-postmortem
• https://www.stepsecurity.io/blog/mini-shai-hulud-is-back-a-self-spreading-supply-chain-attack-hits-the-npm-ecosystem
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-45321

Get alerted when CVE-2026-45321 or the next vulnerability affects your stack