A vulnerability in TanStack Router allows an unauthenticated attacker to craft a server‑function URL that injects attacker‑controlled HTML into an HTTP response. The injected script runs under the application’s same‑origin privileges, enabling the attacker to read or modify local data, issue authenticated requests, and potentially hijack user sessions. The flaw arises from non‑public fields placed in a server‑function request payload that propagate through middleware to the error path, where they are unsanitized and returned to the client. This is a classic reflected XSS scenario (CWE‑79) with high confidentiality, integrity, and availability impact for any visitor to the crafted URL.

Affected vendors include @tanstack for the React, Solid, and Vue start‑frameworks and the TanStack Router itself. Vulnerable product versions are @tanstack/start‑server‑core from 1.143.12 up to 1.169.39, @tanstack/react‑start up to 1.168.60, @tanstack/solid‑start up to 1.168.57, and @tanstack/vue‑start up to 1.168.56. Each product’s latest patched release (listed above) resolves the issue by sanitizing middleware state before it reaches the error handling path.

The CVSS score of 9.3 indicates a critical impact. EPSS data is not available, so the current exploit likelihood cannot be quantified, but the vulnerability is unprotected and can be abused without authentication. It is not listed in the CISA KEV catalog yet, but the high severity suggests that active exploitation is plausible if a malicious actor crafts a malicious URL and lures users to it. The attack vector is inferred to be through a crafted server‑function request URL, which the description explains can be manipulated by an attacker to serve malicious scripts from the application’s origin.