Log in Start free

Vulnerability · Published Aug 24, 2026 · Assigned by VulDB

CVE-2026-78177TanStack devtools-vite Development Devtools Event Bus package-manager.ts installPackage os command injection

Medium 4.5

In plain English

A medium-severity OS command injection in devtools-vite from TanStack. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 60% of all known vulnerabilities).

Severity (CVSS 3.1)4.5Medium
Exploit odds (30 days)0.9%top 40.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A vulnerability was found in TanStack devtools-vite 0.7.0. Affected by this issue is the function installPackage of the file packages/devtools-bundler-core/src/package-manager.ts of the component Development Devtools Event Bus. The manipulation of the argument packageName results in os command injection. Attacking locally is a requirement. A high complexity level is associated with this attack. The exploitation is known to be difficult. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.

Affected products (as reported)

VendorProductVersions
TanStack devtools-vite 0.7.0

Weakness: CWE-78, CWE-77 · Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

References