Description
A vulnerability was found in TanStack devtools-vite 0.7.0. Affected by this issue is the function installPackage of the file packages/devtools-bundler-core/src/package-manager.ts of the component Development Devtools Event Bus. The manipulation of the argument packageName results in os command injection. Attacking locally is a requirement. A high complexity level is associated with this attack. The exploitation is known to be difficult. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
Published: 2026-08-24
Score: 2 Low
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A local attacker can manipulate the packageName argument passed to the installPackage function in TanStack devtools-vite, causing an operating system command to be injected and executed on the host system. The attack requires high complexity and is known to be difficult to exploit, but the vulnerability has been publicly disclosed and could be leveraged by an attacker with local privileges.

Affected Systems

TanStack devtools-vite version 0.7.0 is affected. No other product versions are listed as impacted.

Risk and Exploitability

The CVSS score is 2.0, indicating low overall severity. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires local access, has a high complexity level, and is considered difficult. The attack vector is local, and no remote exploitation is documented.

Generated by OpenCVE AI on August 24, 2026 at 03:20 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade TanStack devtools-vite to the latest released version that contains the fix for the command injection vulnerability.
  • Restrict the use of devtools-vite to trusted users or environments and avoid running it with elevated privileges.
  • If an upgrade is not immediately possible, modify the installPackage function to validate or escape the packageName argument before executing any OS command.
  • Consider running the package installation in an isolated environment (e.g., container or virtual machine) to limit the impact of any potential command injection.

Generated by OpenCVE AI on August 24, 2026 at 03:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 24 Aug 2026 02:45:00 +0000

Type Values Removed Values Added
Description A vulnerability was found in TanStack devtools-vite 0.7.0. Affected by this issue is the function installPackage of the file packages/devtools-bundler-core/src/package-manager.ts of the component Development Devtools Event Bus. The manipulation of the argument packageName results in os command injection. Attacking locally is a requirement. A high complexity level is associated with this attack. The exploitation is known to be difficult. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
Title TanStack devtools-vite Development Devtools Event Bus package-manager.ts installPackage os command injection
First Time appeared Tanstack
Tanstack devtools-vite
Weaknesses CWE-77
CWE-78
CPEs cpe:2.3:a:tanstack:devtools-vite:*:*:*:*:*:*:*:*
Vendors & Products Tanstack
Tanstack devtools-vite
References
Metrics cvssV2_0

{'score': 3.5, 'vector': 'AV:L/AC:H/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 4.5, 'vector': 'CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 4.5, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 2, 'vector': 'CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Tanstack Devtools-vite
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-08-24T02:30:08.352Z

Reserved: 2026-08-23T15:55:56.896Z

Link: CVE-2026-78177

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-24T03:16:40.473

Modified: 2026-08-24T03:16:40.473

Link: CVE-2026-78177

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-24T03:30:05Z

Weaknesses
  • CWE-77

    Improper Neutralization of Special Elements used in a Command ('Command Injection')

  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')