A flaw in the select function of TanStack db’s Alias Path Handler allows an attacker to manipulate object prototype attributes through untrusted input. This prototype pollution can alter program behavior by adding or modifying properties on built‑in objects, potentially leading to unintended side effects. The weakness is identified by CWE‑1321 and CWE‑94, indicating uncontrolled prototype manipulation and code injection respectively.

TanStack db versions up to and including 0.6.8 are impacted. The vulnerability resides in src/query/compiler/select.ts within the Alias Path Handler component. This range covers all releases prior to the patch commit ac09b1177a100eafa85cba3cd09dd1f53f933ded.

The CVSS score of 5.3 denotes moderate severity, while the EPSS score is below 1% and the vulnerability is not listed in CISA’s KEV catalog. An attacker can launch the exploit remotely, and a public exploit demonstrates the ability to induce prototype pollution by feeding malicious input into the select function. The low EPSS indicates that incidents are presently rare, but the impact of prototype pollution can be widespread if the affected code executes in a privileged context.